SB2026101258 - Multiple vulnerabilities in MarkLogic
Published: October 12, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 31 vulnerabilities.
1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-85961)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to obtain unauthorized access to protected cloud resources.
The vulnerability exists due to insertion of security-sensitive authentication information into diagnostic logs when recording diagnostic information under certain configurations. A local user can use authentication information from accessible diagnostic logs to obtain unauthorized access to protected cloud resources.
The issue affects Azure deployments and requires access to the affected logs.
2) HTTP response splitting (CVE-ID: CVE-2026-85976)
CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to split HTTP responses and cause unintended client-side response handling.
The vulnerability exists due to improper neutralization of CRLF sequences in HTTP headers in the Query Console file-exploration endpoint when processing input used in responses. A remote user can supply insufficiently sanitized input to split HTTP responses and cause unintended client-side response handling.
3) Cleartext transmission of sensitive information (CVE-ID: CVE-2026-85975)
CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to intercept data or credentials transmitted to Amazon S3.
The vulnerability exists due to cleartext transmission of sensitive information in Amazon S3 connections when using affected connections. A remote attacker can intercept traffic from a position on the network to obtain transmitted data or credentials.
Affected connections may use cleartext transport by default.
4) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-85974)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to intercept or modify communications with an affected service.
The vulnerability exists due to improper validation of TLS certificate hostnames in certain outbound connections when validating service certificates. A remote attacker can exploit the hostname-validation weakness from a position on the network to intercept or modify communications with an affected service.
5) Cleartext transmission of sensitive information (CVE-ID: CVE-2026-85973)
CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to intercept or modify cluster-management information.
The vulnerability exists due to cleartext transmission of information in certain cluster-management communications when using affected connections. A remote attacker can intercept or modify traffic from a position on the network to read or alter information transmitted through an affected connection.
6) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-85972)
CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain unauthorized access to or modify protected data.
The vulnerability exists due to insufficient verification of the Kerberos authentication service's identity in password-based authentication when communicating with authentication infrastructure. A remote attacker can impersonate trusted authentication infrastructure from a position on the network to obtain unauthorized access to or modify protected data.
Only certain password-based authentication configurations are affected.
7) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-85971)
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read or alter log data.
The vulnerability exists due to overly permissive operating-system permissions on certain log files when assigning file permissions. A local user can access the affected log files through those permissions to read or alter log data.
8) XML External Entity injection (CVE-ID: CVE-2026-85970)
CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause server-side requests or disclose local files.
The vulnerability exists due to improper restriction of XML external entity references in multiple server paths when processing XML. A remote user can supply crafted XML to cause server-side requests or disclose local files.
XML external entity processing is enabled by default in the affected paths.
9) Out-of-bounds write (CVE-ID: CVE-2026-85969)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause server instability or make limited modifications to data.
The vulnerability exists due to an out-of-bounds write in certain language-processing functionality when processing language input. A remote user can exploit the affected language-processing functionality to cause server instability or make limited modifications to data.
10) Out-of-bounds read (CVE-ID: CVE-2026-85968)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause server instability or disclose limited information from process memory.
The vulnerability exists due to an out-of-bounds read in certain query-processing functionality when processing queries. A remote user can exploit the affected query-processing functionality to cause server instability or disclose limited information from process memory.
11) Cross-site scripting (CVE-ID: CVE-2026-85967)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute script in an authenticated user's browser session.
The vulnerability exists due to cross-site scripting in the server's web content when generating content rendered in an authenticated user's browser. A remote attacker can exploit the cross-site scripting flaw to execute script in that browser session and perform unauthorized actions or disclose information accessible to the user.
12) Information disclosure (CVE-ID: CVE-2026-85966)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to obtain security-sensitive information and potentially access protected resources without authorization.
The vulnerability exists due to insufficient access restrictions in the server when exposing security-sensitive information. A remote user can obtain the insufficiently restricted information to potentially access protected resources without authorization.
Exploitation requires limited management permissions.
13) Use-after-free (CVE-ID: CVE-2026-85965)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to corrupt memory or cause process failure or server instability.
The vulnerability exists due to use-after-free in the JavaScript engine integration when processing JavaScript. A remote user can exercise the affected JavaScript engine integration to corrupt memory or cause process failure or server instability.
14) Path traversal (CVE-ID: CVE-2026-85964)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose arbitrary server files.
The vulnerability exists due to path traversal in a privileged filesystem helper when processing user-supplied path values. A remote user can supply unsafe path values through Query Console to disclose arbitrary server files.
15) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-85963)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain unauthorized access to protected information.
The vulnerability exists due to server-side request forgery and use of a hard-coded cryptographic key in deprecated OpsDirector functionality when handling requests to services. A remote attacker can make unauthorized requests to internal services or forge trusted requests to obtain unauthorized access to protected information.
16) Improper Authentication (CVE-ID: CVE-2026-85962)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain unauthorized access.
The vulnerability exists due to improper authentication in SAML processing when validating assertions. A remote attacker can cause the server to accept a SAML assertion that should be rejected to obtain unauthorized access.
Exploitation applies to deployments that use SAML authentication.
17) Origin validation error (CVE-ID: CVE-2026-9191)
CWE-ID: CWE-346 - Origin Validation Error
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform unauthorized actions or compromise an authenticated session.
The vulnerability exists due to insufficient isolation of user-supplied code from HTTP request, response, and session state in certain REST and XDBC evaluation paths when executing user-supplied code. A remote user can execute code through an affected evaluation path to perform unauthorized actions or compromise an authenticated session.
18) Cross-site request forgery (CVE-ID: CVE-2026-85960)
CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to submit unauthorized requests and execute server-side code with a victim's permissions.
The vulnerability exists due to predictable CSRF tokens in Query Console when validating requests. A remote attacker can lure an authenticated Query Console user to a malicious page to submit unauthorized requests and execute server-side code with the victim's permissions.
19) Insufficient Logging (CVE-ID: CVE-2026-85959)
CWE-ID: CWE-778 - Insufficient Logging
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to authenticate without consistently generating a successful-authentication audit record.
The vulnerability exists due to insufficient logging in authentication auditing when recording successful authentication events. A remote user can successfully authenticate without a corresponding event being consistently recorded to limit detection and investigation of unauthorized access or credential misuse.
20) Improper Authentication (CVE-ID: CVE-2026-85958)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain unauthorized access.
The vulnerability exists due to improper authentication in the server when validating authentication tokens. A remote attacker can use a token that should not be accepted by the affected server to obtain unauthorized access.
21) XML External Entity injection (CVE-ID: CVE-2026-85957)
CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause unintended network access or disclose information.
The vulnerability exists due to improper restriction of XML external entity references in the SAML parser when processing external DTDs or entities. A remote attacker can supply SAML input containing external DTDs or entities to cause unintended network access or disclose information.
22) Improper privilege management (CVE-ID: CVE-2026-85956)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to access or modify security-critical data without authorization.
The vulnerability exists due to improper privilege management in forest backup and restore operations when enforcing the authorized database scope. A remote privileged user can perform backup or restore operations on forests outside that scope to access or modify security-critical data without authorization.
Exploitation requires delegated database-administrator privileges.
23) Improper privilege management (CVE-ID: CVE-2026-85955)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute server-side code with elevated permissions.
The vulnerability exists due to improper privilege management in an XQuery evaluation function when checking the additional required evaluation privilege. A remote user can invoke the affected evaluation function without that privilege to execute server-side code with elevated permissions.
Exploitation requires query-execution access.
24) Improper privilege management (CVE-ID: CVE-2026-85954)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges beyond granted permissions.
The vulnerability exists due to improper privilege management in certain higher-order XQuery functions when evaluating user-controlled values in an elevated security context. A remote user can supply values to affected higher-order XQuery functions to escalate privileges beyond granted permissions.
25) Path traversal (CVE-ID: CVE-2026-85953)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access server files without authorization or execute operations under an unintended identity.
The vulnerability exists due to path traversal and improper privilege management in privileged legacy InfoStudio modules when processing user-controlled file paths and user-context values. A remote user can supply unsafe file paths or user-context values to access server files without authorization or execute operations under an unintended identity.
26) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-85952)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access internal cloud services and potentially obtain cloud credentials.
The vulnerability exists due to server-side request forgery in the server when accessing internal cloud services. A remote user can exploit the request-forgery flaw to access internal cloud services and potentially obtain cloud credentials.
The issue affects Linux-based deployments.
27) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-85951)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access internal cloud services and potentially obtain cloud credentials or tokens.
The vulnerability exists due to server-side request forgery in the server when accessing internal cloud services. A remote user can exploit the request-forgery flaw to access internal cloud services and potentially obtain cloud credentials or tokens.
The issue affects Azure deployments.
28) Improper privilege management (CVE-ID: CVE-2026-85950)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to access higher-privileged users' authentication material and potentially obtain unauthorized administrative access.
The vulnerability exists due to improper privilege management in the server when authorizing access to authentication material. A remote privileged user can exploit the authorization flaw to access authentication material associated with higher-privileged users and potentially obtain unauthorized administrative access.
29) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-85949)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to obtain unauthorized access to protected resources.
The vulnerability exists due to insertion of security-sensitive information into diagnostic logs when recording diagnostic information under certain configurations. A local user can use sensitive information from accessible diagnostic logs to obtain unauthorized access to protected resources.
Exploitation requires access to the affected logs.
CWE-ID: CWE-652 - Improper Neutralization of Data within XQuery Expressions (\'XQuery Injection\')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to obtain persistent unauthorized administrative control.
The vulnerability exists due to XQuery injection in a deprecated Management API package path when processing input through that path. A remote privileged user can exploit the XQuery-injection flaw to obtain persistent unauthorized administrative control.
Exploitation requires manage-user-level privileges.
31) Improper privilege management (CVE-ID: CVE-2026-85947)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to obtain persistent unauthorized administrative control of the server.
The vulnerability exists due to improper privilege management in certain forest-management operations when authorizing those operations. A remote privileged user can exploit the authorization flaw to create a persistent unauthorized administrator account and obtain administrative control of the server.
Exploitation requires forest-management privileges.
Remediation
Install update from vendor's website.