Apache CouchDB

Querying CouchDB

curl "https://api.attestd.io/v1/check?product=couchdb&version=3.2.1" \
  -H "Authorization: Bearer $ATTESTD_KEY"

CouchDB 3.2.1 is affected by CVE-2022-24706. A default Erlang cookie plus an exposed distribution port grants unauthenticated admin access and an RCE path. The response shows risk_state: "critical" with actively_exploited: true because the CVE is on the CISA KEV catalog.

{
  "product": "couchdb",
  "version": "3.2.1",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "active_exploitation",
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": true,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "3.3.3",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2022-24706",
    "CVE-2023-26268",
    "CVE-2023-45725"
  ],
  "cves": null,
  "max_epss": 0.92414,
  "last_updated": "2026-08-16T11:14:54.987653Z",
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null,
    "source_published_at": null,
    "observed_at": null,
    "ingested_at": null,
    "first_served_at": null,
    "provenance": null
  },
  "supply_chain_monitored": true,
  "typosquat": null
}

CouchDB 3.4.2 is past the CVE-2022-24706 fix (3.2.2) and outside the CVE-2021-38295 HTML attachment XSS range (fixed in 3.1.2).

curl "https://api.attestd.io/v1/check?product=couchdb&version=3.4.2" \
  -H "Authorization: Bearer $ATTESTD_KEY"

CVE history

CouchDB CVEs repeatedly exploit trust in cluster membership and admin configuration. CVE-2022-24706 made the default Erlang cookie and open distribution port a KEV-listed remote admin path. Earlier 1.x and 2.x issues abused _users document types and OS process configuration to escalate to admin or execute host commands.

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

Apache CouchDB CPE

NVD uses a single Apache product identifier for CouchDB releases. Affected ranges often split 1.x and 2.x branches in the same CVE record.

Query product=couchdb with a dotted release. Attestd matches branch-specific ranges and surfaces KEV status on the aggregated response.