Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-10-12T16:17:06.303Z",
  "pubdate": "2026-10-12T16:17:06.303Z",
  "executiveSummary": "A vulnerability has been identified in Progress MarkLogic Server that results in the improper logging of security-sensitive information within diagnostic log files.\nThe vulnerability affects versions 12.x prior to 12.1.0 and 11.x prior to 11.3.7.\nBy capturing sensitive data in cleartext or an otherwise accessible format within diagnostic logs, the server facilitates unauthorized information disclosure.\nAn attacker with authorized or unauthorized access to these log files can leverage the captured credentials, tokens, or configuration secrets to escalate privileges or bypass security controls.\nThe risk implication is significant as log files are often stored with broader read permissions than primary security databases, potentially exposing critical authentication material to unauthorized internal actors or attackers who have gained initial foothold via other vectors.\nExploitation does not necessarily require complex remote execution capabilities; rather, it relies on the attacker's ability to read log files generated under specific server configurations.",
  "technicalDetails": "The vulnerability originates from the improper sanitization and filtering of data handled during the logging process in Progress MarkLogic Server. Under specific, non-default, or verbose diagnostic logging configurations, the application logic fails to redact sensitive authentication parameters or internal security-sensitive identifiers before writing them to the persistent storage logs.\nThis behavior exposes sensitive material that should remain protected by the security boundary of the application's authentication module. The root cause is an insufficient data classification mechanism within the logging subsystem, which allows internal memory structures containing sensitive credentials or tokens to be serialized into the diagnostic diagnostic output streams.\nThe attack flow proceeds as follows: First, the server is configured to a diagnostic logging level that inadvertently captures verbose input/output operations or session-specific metadata. Second, the target system performs an operation that triggers the inclusion of sensitive data in the logged stream. Third, an adversary who has obtained read access to the file system—potentially via a separate local file inclusion vulnerability, insecure log management platform, or compromised administrative account—accesses the diagnostic log files.\nOnce the logs are retrieved, the attacker parses the contents to extract security-sensitive tokens, passwords, or session identifiers. These extracted values are then utilized to facilitate unauthorized access to protected resources, perform unauthorized API requests, or impersonate legitimate administrative users. The impact is a complete bypass of the security controls associated with the leaked credentials, leading to a potential total compromise of the data stored within the affected MarkLogic cluster.\nAffected versions include Progress MarkLogic Server releases 11.x prior to 11.3.7 and 12.x prior to 12.1.0. The vulnerability is persistent as long as the affected software version remains in use and the diagnostic logs containing the sensitive information are retained or actively generated by the server's logging subsystem. No specific network exposure is required for the initial logging error; however, the impact is magnified in environments where log aggregation services are improperly secured, allowing for lateral movement or privilege escalation across the infrastructure."
}