CVE-2026-85972 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Progress MarkLogic Server versions prior to 12.1.0 and 11.x releases before 11.3.7 represents a critical failure in the verification of Kerberos authentication services during password-based authentication workflows. This flaw stems from an insufficient validation mechanism where the server does not rigorously confirm the identity of the Key Distribution Center or Ticket Granting Service acting as the trusted authority for user credentials. In standard Kerberos operations, the client and service must mutually verify tickets to ensure they are communicating with legitimate entities within the realm. However, in this specific configuration, MarkLogic Server accepts authentication tokens without fully validating that they originate from an authorized and expected identity provider. This oversight creates a significant gap in the trust chain required for secure single sign-on and enterprise authentication architectures.
From a technical perspective, this deficiency allows for classic man-in-the-middle attacks or rogue server impersonation scenarios. An attacker positioned within the network path between the MarkLogic Server and the Kerberos infrastructure can intercept authentication requests or inject forged tickets. Because the server fails to sufficiently verify the identity of the authenticating service, it may accept credentials presented by an unauthorized entity as if they were issued by a legitimate domain controller. This effectively bypasses the intended access controls, allowing the attacker to authenticate as any user whose credentials are compromised or who can be tricked into submitting their login information to the rogue service. The vulnerability is particularly dangerous in environments where MarkLogic Server handles sensitive data repositories, as it undermines the foundational integrity of the authentication layer.
The operational impact of this vulnerability is severe, primarily centering on unauthorized access and potential data modification. An attacker who exploits this flaw can gain elevated privileges within the MarkLogic environment without possessing valid credentials for those accounts. This could lead to the exfiltration of confidential documents stored in the database, alteration or deletion of critical records, and further lateral movement into other connected systems that trust the compromised MarkLogic instance. The ability to impersonate trusted authentication infrastructure means that audit logs may record legitimate-looking login events from an attacker's perspective, complicating forensic analysis and incident response efforts. Organizations relying on this software for high-security applications face significant risks of data breaches and regulatory non-compliance due to these unauthorized access capabilities.
To mitigate the risk associated with CVE-2024-35196 or similar identity verification flaws in MarkLogic Server, immediate patching is required by upgrading to version 12.1.0 or later for the 12.x branch, and version 11.3.7 or later for the 11.x branch. These updates include corrections that enforce strict validation of Kerberos service identities during password-based authentication processes. In addition to applying vendor patches, organizations should implement network segmentation strategies to restrict direct communication between MarkLogic servers and external identity providers where possible. Utilizing mutual TLS alongside Kerberos can provide an additional layer of verification for the server's identity. Security teams should also monitor logs for anomalous authentication patterns that may indicate exploitation attempts while updates are being deployed across the infrastructure.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically regarding the failure to verify the identity of a principal or service during an authentication exchange. It is further categorized under ATT&CK technique T1098, Account Manipulation, as it allows attackers to manipulate trust relationships to gain unauthorized access. The lack of proper validation against industry standards for secure Kerberos implementation highlights the importance of rigorous security testing in database management systems that integrate with enterprise identity providers. Ensuring that all components of the authentication chain are verified prevents adversaries from exploiting weak links in the trust model, thereby maintaining the confidentiality and integrity of protected data assets.