CVE-2026-85960: Cross-site request forgery in Progress MarkLogic Server Query Console
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Server Query Consoleto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Server Query Consoleto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Organizations running Progress MarkLogic Server 12.x before 12.1.0 or 11.x before 11.3.7 are affected when users are authenticated to Query Console. The attacker is remote and does not need their own account, but must induce an authenticated user to visit a malicious page.
What could an attacker do through this issue?
The attacker could submit unauthorized Query Console requests in the authenticated victim's context. This can result in server-side code execution with that user's permissions, affecting confidentiality, integrity, and availability.
How can we determine whether our deployment is affected?
Check the MarkLogic Server release branch and version used by Query Console. Versions in the 12.x branch earlier than 12.1.0 and versions in the 11.x branch earlier than 11.3.7 are affected.