CVE-2026-85949: Sensitive information exposure in Progress MarkLogic Server trace logs
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have access to diagnostic logs generated by an affected MarkLogic Server deployment. The provided information does not establish that unauthenticated remote attackers can access those logs directly.
Which releases are affected?
MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may be affected. The issue occurs under certain configurations that cause security-sensitive information to be recorded in diagnostic logs.
What is the impact if affected logs are exposed?
Information in the logs could allow an attacker to obtain unauthorized access to protected resources. The stated impact includes high integrity and availability effects, with no confidentiality impact in the supplied vector.