CVE-2026-85951: Server-side request forgery in Progress MarkLogic Server Azure deployments
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects Progress MarkLogic Server deployments on Azure running 12.x versions before 12.1.0 or 11.x versions before 11.3.7. The provided information does not identify impacts for non-Azure deployments.
What access does an attacker need to exploit this?
An attacker must be authenticated to the affected MarkLogic Server instance. No user interaction is required, and the attack can be performed over the network.
What could an attacker access through this issue?
The vulnerability may let an authenticated attacker make requests to internal cloud services. This could expose cloud credentials or tokens and lead to unauthorized access.
What versions remediate the issue?
Upgrade Azure deployments to MarkLogic Server 12.1.0 or later in the 12.x line, or 11.3.7 or later in the 11.x line.