Inclusion of Sensitive Information in Log Files in MarkLogic - CVE-2026-85961
Published: October 12, 2026
Vulnerability identifier: #VU154134
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85961
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to obtain unauthorized access to protected cloud resources.
The vulnerability exists due to insertion of security-sensitive authentication information into diagnostic logs when recording diagnostic information under certain configurations. A local user can use authentication information from accessible diagnostic logs to obtain unauthorized access to protected cloud resources.
The issue affects Azure deployments and requires access to the affected logs.
Affected software
MarkLogic
How to mitigate CVE-2026-85961
Install security update from vendor's website.
MarkLogic - addressed in versions 11.3.7, 12.1