CVE-2022-24706 Apache CouchDB Insecure Default Initialization of Resource

Exploited in the wild Critical 9.8 Published 26 Apr 2022 Updated 21 Oct 2025

Attackers can bypass authentication on improperly secured CouchDB installations to gain admin privileges and execute code.

Exploited in the wild: Since 25 Aug 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-24706?

CVE-2022-24706 is a critical authentication bypass vulnerability in Apache CouchDB, published on 26 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Weakness: CWE-1188

Which versions are affected by CVE-2022-24706?

1 open source package ship an affected version, including couchdb. It affects 1 product.

Package	Affected	Fixed in
`couchdb` Bitnami	All versions	`3.2.2`

Products include Apache Couchdb.

How do I fix CVE-2022-24706?

Upgrade couchdb to 3.2.2 or later. US federal agencies must fix it by 15 Sep 2022.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-24706 being exploited?

Yes. Attackers have exploited CVE-2022-24706 in the wild since at least 25 Aug 2022.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 5 proofs of concept on GitHub.

Sources

Also known as BIT-couchdb-2022-24706, GHSA-vxc9-8m8h-9cp6, MGASA-2022-0466.