⚡ 情报报告

两个关键的 MarkLogic 漏洞可能使委托管理员获得持久的管理员控制权

📰 The Hacker News 🕐 Oct 13, 2026 08:44 ⏱ 1 分钟阅读 ⚠️ 21 个漏洞

Progress Software 的 MarkLogic Server 数据库新披露的 31 个漏洞中，有两个可能让仅被授予部分管理权限的账户获得服务器的管理员控制权，该公司表示。

Progress 于 10 月 12 日发布了所有 31 个漏洞，并将其中五个评为关键。自 9 月 10 日起，MarkLogic 11.3.7 和 MarkLogic 12.1.0 中已提供修复。

受影响的版本及其修复版本：

MarkLogic 11.x 版本在 11.3.7 之前：升级到 11.3.7

MarkLogic 12.x 版本在 12.1.0 之前：升级到 12.1.0

MarkLogic 11.3 是长期支持（LTS）版本。Progress 称 12 版本为创新版本，没有修补的 12.0 版本。其修复版本为 12.1.0，同时增加了新功能。

仅安装 Progress 在 8 月披露的 10 个 MarkLogic 漏洞的修复是不够的。这些修复在 11.3.6 和 12.0.3 中发布，而这两个版本都受到新漏洞的影响。

Progress 的 CVE 记录及其两个版本的升级说明没有说明这 31 个漏洞是否已被用于攻击。当《黑客新闻》在 10 月 13 日检查时，没有任何漏洞出现在美国网络安全和基础设施安全局的已知被利用漏洞目录中。

同样的记录和说明没有列出尚未升级的客户的任何解决方法。

关键漏洞的影响

Progress 将五个关键漏洞中的三个在 CVSS 评分中评为 9.9，另外两个评为 9.6。根据公司的 CVE 记录，攻击者必须已经拥有某种权限或能够在服务器上运行代码。

其中两个漏洞涉及森林。在 MarkLogic 中，森林是附加到数据库的一组文档。

CVE

评分

攻击者需要的条件

可能允许的操作

CVE-2026-85947

9.9

森林管理权限

创建一个持久的管理员账户，可能赋予对服务器的完全管理控制权

CVE-2026-85948

9.9

用户管理权限

通过过时的管理 API 路径中的 XQuery 注入漏洞获得持久的管理员控制权

CVE-2026-85955

9.9

查询执行访问权限和 xdmp-eval-in 权限

以提升的权限运行服务器端代码

CVE-2026-85956

9.6

委托的数据库管理员权限

备份或恢复其自身数据库之外的森林，允许访问或更改 Progress 所称的“安全关键数据”

CVE-2026-9191

9.6

通过某些 REST 和 XDBC 评估路径运行代码的能力

执行未经授权的操作或危害已认证会话

CVE-2026-85947 的修复显示了哪些账户存在问题。升级说明指出，“森林范围的管理授权”单独已不足以将森林附加到所选数据库。它们还告知客户在升级前审查委托的森林和数据库权限分配，并审计持有 xdmp-eval-in 的角色。

外部研究人员通过 Bugcrowd 报告了五个漏洞中的四个。使用化名 rexnets 的研究人员被认为是 CVE-2026-85947、CVE-2026-85948 和 CVE-2026-85956 的贡献者，而使用化名 WaltWhitehat 的研究人员被认为是 CVE-2026-9191 的贡献者。

依赖配置的漏洞

Progress 将剩余的漏洞中有 24 个评为高危，两个评为中危。最高的 CVE-2026-85954 评分为 8.6，可能允许攻击者通过向某些 XQuery 函数传递值来获得超出授权的权限。

其他几个漏洞仅在使用特定功能或平台时适用：

SAML：在使用 SAML 身份验证的部署中，未经身份验证的远程攻击者可能使服务器接受其应拒绝的声明（CVE-2026-85962）。在 11.x 中，SAML 解析器也可能处理外部 DTD 或实体（CVE-2026-85957）。

OAuth：攻击者可能使用服务器不应接受的令牌（CVE-2026-85958）。修复增加了对 Ping Identity 和其他 OAuth 配置的发行者和受众检查。

基于密码的 Kerberos：在某些配置中，位于网络上的攻击者可能冒充 Kerberos 身份验证服务（CVE-2026-85972）。

云托管：经过身份验证的攻击者可能访问内部云服务并在 Azure（CVE-2026-85951）和基于 Linux 的云部署（CVE-2026-85952）上获取云凭据。

诊断日志：在某些配置下，服务器可能将安全敏感信息写入诊断日志（CVE-2026-85949 和在 Azure 上的 CVE-2026-85961）。当启用受影响的 IAM 跟踪路径时，AWS 秘密密钥和会话令牌以明文形式写入，升级说明中提到。

Amazon S3：对 S3 的连接默认可能使用明文（CVE-2026-85975）。

查询控制台：远程攻击者如果让已登录的查询控制台用户打开恶意页面，可能会以该用户的权限运行服务器端代码（CVE-2026-85960）。经过身份验证的查询控制台用户可能读取任意服务器文件（CVE-2026-85964）。

遗留组件：OpsDirector，一个已弃用的功能，可能让未经身份验证的远程攻击者向内部服务发起请求或伪造受信请求（CVE-2026-85963）。遗留的 InfoStudio 模块可能会访问服务器文件（CVE-2026-85953）。

其余的漏洞包括三个内存安全漏洞、一个跨站脚本漏洞、查询控制台中的 HTTP 响应拆分、某些出站连接上的不一致 TLS 主机名检查，以及 12.x 上的明文集群管理流量。

升级更改的内容

Progress 告诉客户在升级前阅读其升级说明、11.3.7 的已知不兼容性以及 12.1.0 的已知不兼容性。11.3.7 的说明列出了与 22 个漏洞相关的行为更改，12.1.0 的说明列出了与 21 个漏洞相关的行为更改。

可能会破坏现有代码、工具或自动化的更改包括：

mlcp：旧版本的 MarkLogic 内容泵（mlcp）在新版本中会因 XDMP-ISOLATED 错误而失败。Progress 推荐使用 mlcp 11.3.7 或 12.1.0。旧版本可以通过将 -restrict_hosts 设置为 true 来运行，但可能会降低性能。

已移除的功能：/manage/v2/packages API、InfoStudio 和 OpsDirector 被移除。

新默认值：XML 外部实体处理已关闭。

相关漏洞

CVE-2026-85975 CVSS 7.5 HIGH Received

CVE-2026-85975 - Cleartext transmission in Progress MarkLogic Server Amazon S3 connections

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.

CVE-2026-85972 CVSS 7.4 HIGH Received

CVE-2026-85972 - Improper Kerberos server verification in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.

CVE-2026-85964 CVSS 7.7 HIGH Awaiting Analysis

CVE-2026-85964 - Path traversal in Progress MarkLogic Server Query Console

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.

CVE-2026-85963 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85963 - Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.

CVE-2026-85962 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85962 - Improper authentication in Progress MarkLogic Server SAML processing

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that should be rejected, potentially resulting in unauthorized access.

CVE-2026-85961 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85961 - Sensitive information exposure in Progress MarkLogic Server Azure deployments

On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected cloud resources.

CVE-2026-85960 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85960 - Cross-site request forgery in Progress MarkLogic Server Query Console

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.

CVE-2026-85959 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85959 - Insufficient authentication logging in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.

CVE-2026-85958 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85958 - Improper OAuth token validation in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.

CVE-2026-85957 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85957 - Improper XML external entity restriction in Progress MarkLogic Server SAML processing

Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.

CVE-2026-9191 CVSS 9.6 CRITICAL Received

CVE-2026-9191 - Insufficient isolation of user-supplied code in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.

CVE-2026-85956 CVSS 9.6 CRITICAL Awaiting Analysis

CVE-2026-85956 - Improper privilege management in Progress MarkLogic Server backup and restore operations

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.

CVE-2026-85955 CVSS 9.9 CRITICAL Awaiting Analysis

CVE-2026-85955 - Improper privilege management in Progress MarkLogic Server xdmp:eval-in

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

CVE-2026-85954 CVSS 8.6 HIGH Awaiting Analysis

CVE-2026-85954 - Improper privilege management in Progress MarkLogic Server higher-order XQuery functions

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.

CVE-2026-85953 CVSS 8.5 HIGH Awaiting Analysis

CVE-2026-85953 - Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.

CVE-2026-85952 CVSS 8.5 HIGH Awaiting Analysis

CVE-2026-85952 - Server-side request forgery in Progress MarkLogic Server Linux cloud deployments

Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials.

CVE-2026-85951 CVSS 8.5 HIGH Awaiting Analysis

CVE-2026-85951 - Server-side request forgery in Progress MarkLogic Server Azure deployments

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.

CVE-2026-85949 CVSS 8.1 HIGH Awaiting Analysis

CVE-2026-85949 - Sensitive information exposure in Progress MarkLogic Server trace logs

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.

CVE-2026-85948 CVSS 9.9 CRITICAL Awaiting Analysis

CVE-2026-85948 - Improper privilege management in Progress MarkLogic Server Management API

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

CVE-2026-85947 CVSS 9.9 CRITICAL Awaiting Analysis

CVE-2026-85947 - Improper privilege management in Progress MarkLogic Server forest operations

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.

CVE-2026-9192 CVSS 9.8 CRITICAL Analyzed

CVE-2026-9192 - Authentication bypass in Progress MarkLogic Server ODBC App Server

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.

两个关键的 MarkLogic 漏洞可能使委托管理员获得持久的管理员控制权

相关漏洞

更多来自 The Hacker News