CVE-2022-24706: Apache CouchDB Insecure Default Initialization of Resource Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 92.5% chance of exploitation in the next 30 days.

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Affected products

• Apache CouchDB: before 3.2.2 (fixed in 3.2.2)

Published 2022-04-26. Last modified 2026-06-17.