CVE-2017-12636: Apache CouchDB admin config allows OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw gives admin-level attackers remote command execution with a very high EPSS score and public exploit code, though it requires existing admin credentials and is not in KEV.

What it is

Apache CouchDB lets administrative users set configuration options, including paths to operating system binaries that CouchDB later launches. Because those values are not safely handled, an admin can point them at arbitrary commands, resulting in OS command injection. The flaw affects CouchDB before 1.7.0 and 2.x before 2.1.1.

Impact

An attacker with admin access gains arbitrary shell command execution as the CouchDB service account, including the ability to download and run scripts from the internet. This can lead to full compromise of the host and any data reachable by that account.

Attack surface

Reachable over the network via the CouchDB HTTP(S) administrative interface, as reflected in the CVSS vector AV:N. Exploitation requires high privileges (PR:H) and no user interaction (UI:N), so the attacker must already hold CouchDB admin credentials.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.8973 (99.78th percentile), and public exploit code exists in Exploit-DB (44913, 45019). No ransomware group use is documented in the record.

What to do

• Upgrade to CouchDB 1.7.0 or 2.1.1 (or later) to remove the vulnerable configuration behavior.
• Restrict network access to the CouchDB admin interface; do not expose port 5984 or the admin API to untrusted networks.
• Rotate and tightly control CouchDB admin credentials, and audit which accounts hold admin rights.
• Run CouchDB under a low-privilege service account with no unnecessary filesystem or network reach.
• Monitor and lock down configuration changes that reference external binaries or script paths.

Detection

• Alert on CouchDB configuration changes that set binary or script paths, especially via the admin HTTP API.
• Monitor for child processes spawned by the CouchDB service account, particularly shells or download utilities.
• Watch for outbound network connections from the CouchDB host to unfamiliar internet hosts.
• Review CouchDB logs for admin API calls that modify configuration values.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.