Critical CouchDB and certifi fixes land with Tomcat auth bypass patch

Three high-impact open source security disclosures hit oss-security in the same window, covering a critical Apache CouchDB flaw that lets server admins run OS commands, a critical certifi root-store cleanup after a certificate authority key compromise, and an important Apache Tomcat authentication bypass in JNDIRealm.

Apache CouchDB tracked the most severe of the batch as CVE-2026-86471, rated critical at CVSS 4.0 9.3. In versions before 3.5.3, an unvalidated runtime configuration value let a CouchDB server administrator execute arbitrary shell commands as the CouchDB operating system user on all platforms. Operators should move to 3.5.3, which closes the issue. Jan Lehnardt relayed the advisory for the project.

Separately, the Python packaging ecosystem flagged a CRITICAL update for certifi. Version 2026.10.19 removes emSign root certificates from the bundled trust store after related intermediates were revoked for key compromise. A compromised CA key can be used to mint certificates that enable man-in-the-middle attacks. Seth Larson’s security-announce note urges upgrades to certifi 2026.10.19 and rebuilds of container images so CA stores actually pick up the change. The issue is filed as GHSA-6q48-6c7w-9gw2.

Apache Tomcat disclosed CVE-2026-101296, rated important. When JNDIRealm was configured with a non-GSSAPI SASL mechanism, a missing step in authentication allowed attackers to authenticate without the correct password. The flaw spans a long support arc: 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122, with older EOL lines 8.5.x and 7.0.x also known to be affected. Fixed releases are 11.0.27, 10.1.61, and 9.0.123. Credit for the finding goes to ai Sreewathsa Kovalluri, Shon Babu, and Kannan K of Innspark Solutions. Mark Thomas posted the Tomcat notice.

Taken together, the batch is operationally heavy: CouchDB admins need a point release to stop configuration-driven command execution, Python and container maintainers need certifi refreshed and images rebuilt to drop the untrusted emSign roots, and Tomcat sites using JNDIRealm with non-GSSAPI SASL must upgrade to restore proper bind credential checks. Prioritize production systems that expose admin interfaces, ship custom container CA bundles, or rely on directory-backed Tomcat logins.