CVE-2022-24706: Apache CouchDB insecure default leads to unauthenticated admin and RCE
The short version: Apache CouchDB has an insecure-default flaw (CVE-2022-24706) that lets an attacker reach an improperly secured installation without authenticating, gain administrative privileges, and — through CouchDB's Erlang distribution layer — execute code on the server. It scores 9.8 and it's in CISA's Known Exploited Vulnerabilities catalog. Upgrade, and get the Erlang ports off the internet. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (unauthenticated admin → code execution on an exposed node) |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 92.51% · 99.82th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-09-15 |
| Known exploited? | Yes — added to KEV on 2022-08-25 |
| Vulnerability type | CWE-1188 insecure default initialization → unauthenticated privilege escalation → remote code execution |
| Requires authenticated session? | No — the flaw is the default configuration |
| Affected | Apache CouchDB before 3.2.2 |
| Fixed in | 3.2.2 |
What you need to know
CVE-2022-24706 is about insecure defaults, not a single bad line of code. A default CouchDB cluster install exposes the Erlang distribution port with a predictable/shared cookie, and an attacker who can reach that layer can join the cluster as a node, escalate to administrative access, and use Erlang to run arbitrary code on the server — all without authenticating.
Why this earns urgency:
- The vulnerable state is the out-of-the-box state. No exotic conditions — an exposed default install is enough.
- It's a full compromise. Admin over the database plus code execution on the host means the data and the machine are both in play.
- It's confirmed exploited and KEV-listed, with a high EPSS reflecting how routinely it's targeted.
CouchDB's documentation has long recommended firewalling the service — which is precisely the mitigation that this flaw punishes teams for skipping.
How serious we see it
High — in practice, for any exposed node.
Unauthenticated escalation to admin plus RCE on an internet-reachable database is top-of-queue, and the KEV listing confirms real-world use. The honest nuance is that the flaw hinges on the default configuration reaching the internet — a properly firewalled CouchDB was never the intended exposure. That's also the reassuring part: it affects a specific version, 3.2.2 fixes it, and closing off the Erlang ports removes the exposure. Confirm you're patched and that the distribution layer isn't reachable.
Recommendations
Straight from Apache's advisory and CISA:
- Patch now. Upgrade Apache CouchDB to 3.2.2 or later.
- Firewall the Erlang layer. Ensure the Erlang distribution/epmd ports are not reachable from untrusted networks — never expose them to the internet.
- Rotate the shared secret. Change the Erlang cookie from any default/predictable value.
- Hunt if it was exposed. Review logs for unexpected cluster nodes, admin actions, and process execution before your patch date.
- Confirm your exposure first. Verify whether any CouchDB node — and its Erlang ports — is reachable from the internet.
How BreachRisk sees it
BreachRisk discovers internet-facing CouchDB instances from little more than your domain, fingerprints the product and version, and flags exposure tied to this KEV-listed vulnerability so it rises to the top of your results. Looking from the outside in is exactly how you catch a default-configuration exposure: the node that was stood up quickly and left reachable shows up as a ranked finding, not a lurking default.