CVE-2026-85975 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Progress MarkLogic Server versions prior to 12.1.0 and 11.x releases before 11.3.7 centers on the improper configuration of transport layer security for external storage integrations, specifically those involving Amazon S3. By default, these software versions establish connections using cleartext protocols rather than enforcing encrypted channels such as HTTPS or TLS. This architectural oversight means that data packets and authentication credentials are transmitted in an unencrypted format across the network interface. The flaw is not necessarily a code execution bug but rather a configuration weakness where secure defaults were not implemented for sensitive external service integrations, leaving the communication channel vulnerable to passive interception by any actor with appropriate network positioning.
From a technical perspective, this issue represents a failure to enforce confidentiality and integrity during data transmission between the MarkLogic Server instance and remote object storage endpoints. When cleartext transport is utilized, all HTTP requests containing sensitive information are exposed in plain text on the wire. This includes access keys, secret keys, session tokens, and potentially large volumes of document content being ingested or retrieved from S3 buckets. An attacker positioned within the same network segment, such as a compromised host on the local area network, or an adversary capable of performing man-in-the-middle attacks at intermediate routing points, can utilize packet sniffing tools to capture these transmissions. The lack of encryption renders standard cryptographic protections ineffective against eavesdropping, allowing for the direct extraction of credentials and data payloads without triggering integrity checks that would detect tampering in a properly secured TLS session.
The operational impact of this vulnerability is severe due to the high privilege level typically associated with database server accounts and the sensitivity of cloud storage credentials. If an attacker successfully intercepts Amazon S3 access keys, they can gain unauthorized read or write access to any bucket configured for use by that MarkLogic instance. This leads directly to data exfiltration, where sensitive business information stored in the database is stolen. Furthermore, if the compromised credentials possess administrative privileges over specific buckets, the attacker could modify or delete critical documents, leading to a denial of service and loss of data integrity. The exposure also facilitates lateral movement within an organization's infrastructure, as cloud provider keys often grant access to other AWS services beyond simple object storage, potentially escalating the scope of the breach significantly.
This vulnerability aligns with CWE-319, which classifies cleartext transmission of sensitive information as a critical weakness in application security design. It also maps closely to MITRE ATT&CK technique T1048, specifically Exfiltration Over Alternative Protocol, where attackers use non-standard or unencrypted channels to avoid detection by traditional network monitoring tools that may not inspect clear-text HTTP traffic deeply. The default configuration behavior highlights a gap in secure-by-default principles, where the burden of security is placed on the administrator rather than being enforced automatically by the software vendor for high-risk integrations.
To mitigate this risk, administrators must immediately review and update their MarkLogic Server configurations to enforce encrypted connections for all Amazon S3 interactions. This involves explicitly setting transport protocols to HTTPS or TLS within the server's external storage configuration settings, ensuring that cleartext fallback is disabled. Organizations should also implement network-level controls such as VPC endpoints with private links to restrict direct internet access and ensure traffic remains within secure AWS infrastructure boundaries where possible. Regular security audits of cloud integration configurations are recommended to verify that encryption is consistently applied across all data pipelines. Additionally, rotating any potentially exposed credentials immediately upon discovery is essential to prevent unauthorized access resulting from past cleartext transmissions.