CVE-2026-85975: Cleartext transmission in Progress MarkLogic Server Amazon S3 connections
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are exposed?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may be affected when they make Amazon S3 connections. The affected behavior may use cleartext transport by default.
What does an attacker need to exploit this issue?
An attacker needs a network position that allows interception of traffic between the affected MarkLogic Server instance and Amazon S3. No authentication or user interaction is required according to the provided severity vector.
What could be exposed if exploitation succeeds?
Data or credentials transmitted through an affected Amazon S3 connection could be intercepted. The provided assessment indicates high confidentiality impact, with no stated integrity or availability impact.
Which versions address the issue?
Update MarkLogic Server 12.x to 12.1.0 or later, or 11.x to 11.3.7 or later. The provided information identifies releases before those versions as affected.