Progress MarkLogic Server: Server-side request forgery in Linux cloud deployments
Summary
A server-side request forgery (SSRF) flaw in Linux-based MarkLogic Server allows an authenticated attacker to make the server send requests to internal cloud services. This can expose cloud credentials, and the CVSS score of 8.5 reflects a high confidentiality impact. The attacker needs a valid low-privilege account, but no user interaction is required.
Affected
- Linux-based MarkLogic Server 11.0.0 to before 11.3.7
- Linux-based MarkLogic Server 12.0.0 to before 12.1.0
- Windows and Azure-specific issues are covered by a separate CVE (CVE-2026-85951), not this one
Fixed in
- Upgrade to MarkLogic Server 11.3.7 or 12.1.0
- Upgrade MarkLogic Content Pump (mlcp) clients to the version matching the server release
- Downgrades are not supported, so plan the upgrade carefully
Workaround
- No vendor-documented workaround found in the sources reviewed. Unknown until the full Progress bulletin has been read.
- Interim measure (not vendor guidance): restrict outbound access from the MarkLogic host to cloud metadata endpoints.
- Interim measure (not vendor guidance): limit who holds authenticated access to the server.
Exploitation
- No public exploit available according to VulDB.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No reports of exploitation in the wild found.
- EPSS 0.0019 (low, early figure).
- CISA KEV status not directly verified.
Our recommendation
- Check whether any MarkLogic Server instances run on Linux and which version they use.
- Upgrade affected instances to 11.3.7 or 12.1.0 and update mlcp clients to match.
- Patch the whole product, as the October 2026 bulletin covers 31 flaws.
- Restrict outbound access to cloud metadata endpoints on MarkLogic hosts.
- If a compromise is suspected, rotate cloud credentials used by the host.
- Review the full Progress bulletin for workarounds and release dates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress MarkLogic Security Alert Bulletin, October 2026 community.progress.com
- CVE record and CNA data (OpenCVE) app.opencve.io
- VulDB entry vuldb.com
- Rapid7 via Vulners vulners.com
- ACN Italy alert on MarkLogic Server www.acn.gov.it
- GBHackers: Critical Progress MarkLogic Server vulnerabilities gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:55.
Original description (NVD)
Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.