Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-10-12T16:17:07.070Z",
  "pubdate": "2026-10-12T16:17:07.070Z",
  "executiveSummary": "This vulnerability involves an improper authorization flaw in Progress MarkLogic Server that allows authenticated users with standard query-execution privileges to bypass security restrictions when invoking specific XQuery evaluation functions.\nThe vulnerability allows for remote server-side code execution (SSCE) with elevated system permissions, bypassing the intended security controls that normally gate-keep the execution of sensitive administrative or system-level XQuery functions.\nThe flaw affects MarkLogic Server 12.x versions prior to 12.1.0 and 11.x versions prior to 11.3.7.\nThe impact of a successful exploit is critical, as it grants an attacker the ability to execute arbitrary code within the context of the server process, potentially leading to full system compromise, data exfiltration, or unauthorized administrative modifications.\nExploitation requires the attacker to possess existing query-execution access to the target instance, meaning the vulnerability is not exploitable by unauthenticated remote users but represents a significant escalation of privilege threat from an authenticated low-privileged account.\nRisk management strategy should prioritize patching to the specified secure versions to enforce proper privilege validation for XQuery evaluation.",
  "technicalDetails": "The root cause of this vulnerability lies in a flaw within the internal access control mechanism that governs the invocation of XQuery evaluation functions within MarkLogic Server. The system fails to enforce mandatory privilege checks when specific evaluation routines are called, effectively treating these calls as implicitly authorized for any user with basic query execution capability.\nIn a secure configuration, the execution of sensitive XQuery functions is protected by a specific evaluation privilege. This design is intended to prevent users from interacting with administrative APIs or performing operations that could lead to host-level command execution. However, due to the oversight in authorization logic, the server fails to validate the presence of this required privilege at the point of invocation.\nThe attack flow begins with an authenticated user crafting a malicious request containing XQuery instructions that leverage these unprotected functions. Because the server does not perform the necessary authorization handshake, the malicious payload is executed by the process engine using the effective permissions of the application or the service itself, rather than the restricted context of the initiating user.\nThe technical implication is an effective privilege escalation. By bypassing the evaluation privilege check, the attacker can invoke functions that interact with the underlying operating system or internal system databases. This results in server-side code execution, where the attacker can manipulate system configuration, access restricted data stores, or escalate to full control over the database node.\nAffected software versions include 12.x releases before 12.1.0 and 11.x releases before 11.3.7. The vulnerability exists within the query evaluation component of the MarkLogic engine. Successful exploitation does not require advanced network positioning, only the ability to submit XQuery requests to the server's endpoint. Once the code execution is achieved, the post-exploitation impact includes persistent unauthorized access and the potential for lateral movement within the data center, assuming the MarkLogic service account has broader system permissions."
}