Inclusion of Sensitive Information in Log Files in MarkLogic - CVE-2026-85949
Published: October 12, 2026
Vulnerability identifier: #VU154122
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85949
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to obtain unauthorized access to protected resources.
The vulnerability exists due to insertion of security-sensitive information into diagnostic logs when recording diagnostic information under certain configurations. A local user can use sensitive information from accessible diagnostic logs to obtain unauthorized access to protected resources.
Exploitation requires access to the affected logs.
Affected software
MarkLogic
How to mitigate CVE-2026-85949
Install security update from vendor's website.
MarkLogic - addressed in versions 11.3.7, 12.1