psf-couchdb-check(8)

Script: /opt/psf-security-patches/couchdb/couchdb-check.sh. Tool page: CouchDB. Source. With the package installed: man psf-couchdb-check.

Apache CouchDB admin-to-OS-command execution: read-only checker  (v1)
CVE-2026-86471

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

An unvalidated runtime configuration value in Apache CouchDB lets a CouchDB
server admin run arbitrary shell commands as the operating system user that
runs CouchDB. CVSS 9.3 on the v4 scale. The attacker needs server-admin
credentials, so this is a privilege escalation from a CouchDB admin (a stolen
or weak admin password, an exposed admin interface, or a compromised
application that holds admin credentials) to the host. It is not a flaw an
anonymous visitor can use alone.

  Affected: Apache CouchDB 3.5.2 and earlier, on all platforms
  Fixed:    3.5.3

The same release fixes other CouchDB flaws, among them a pre-authentication
gzip decompression bomb on POST /_session. That one needs no credentials, which
is why it matters whether the node listens beyond localhost.

This script is read-only. It reads the CouchDB version from the release files
(releases/start_erl.data), the installed package, and, if you give it URLs, from
a single unauthenticated GET of the server's root document. It reads the ini
files for the bind address, require_valid_user and how many admin entries
exist. It NEVER prints a value from the [admins] section (they are password
hashes or passwords).

Usage:
  ./couchdb-check.sh [command] [URL ...]

  check (default)  Exit 0 = nothing affected, 1 = an affected version was found.
                   With URL arguments (such as http://10.0.0.5:5984/) it also
                   asks each server for its version. Without arguments it asks
                   only http://127.0.0.1:5984/ and ignores a refusal.
  version          print the script version.

Environment: COUCHDB_ROOT (default /opt/couchdb) and COUCHDB_ETC (space
separated, default "/opt/couchdb/etc /etc/couchdb /usr/local/etc/couchdb")
point the script at unusual layouts.
Containers: with no argument the check also looks in running docker and podman containers
(SCAN_CONTAINERS=1, the default; 0 skips them). A read-only probe captures the daemon's version
output and its configuration (secrets are redacted inside the container before anything is
copied) into a private temporary directory, and this script then runs once per container, in
isolation, against that copy. Paths shown as .../docker_NAME/... are inside the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.