CVE-2026-85952

Executive Summary

CVE-2026-85952 is a server-side request forgery (SSRF) vulnerability in Progress MarkLogic Server, affecting Linux-based 12.x releases before 12.1.0 and 11.x releases before 11.3.7. An authenticated attacker can induce the server to issue requests to internal services — most critically, cloud instance metadata endpoints — and thereby obtain cloud credentials that grant unauthorized access to cloud resources. With a CVSS score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), the vulnerability is network-exploitable with low complexity but requires authentication; the Scope:Changed and high confidentiality impact reflect the pivot from the MarkLogic host into the surrounding cloud IAM trust boundary.

Technical Analysis

MarkLogic Server is an enterprise NoSQL document database commonly deployed as a multi-model platform behind web and API front ends. This issue falls into the SSRF class (CWE-918). SSRF arises when an application accepts a user-controlled destination — a URL, hostname, or address — and the server-side component fetches that destination on behalf of the caller without adequately restricting it. Because the request originates from the MarkLogic process, it is issued from inside the trust perimeter: the request traverses host firewalls, security groups, and network ACLs that would have blocked the same connection from the internet or from an unprivileged client.

The CNA description explicitly ties exploitation to three conditions: the attacker must be authenticated, the MarkLogic deployment must be Linux-based, and the deployment must run in a cloud environment whose internal services are reachable from the MarkLogic host. The stated outcome — "access internal cloud services, potentially resulting in unauthorized access to cloud credentials" — maps directly to the well-understood cloud metadata attack path. On major cloud providers, the instance metadata service is reachable from the instance's own network namespace (historically at the link-local address 169.254.169.254) and returns temporary IAM role credentials to any process able to reach it. An SSRF that permits requests to that address, or to an internal services endpoint such as an IAM or token service, effectively escalates a database-auth-level foothold into cloud-API-level access.

The provided data does not disclose which MarkLogic component implements the vulnerable fetch, nor the parameter or endpoint that carries the attacker-controlled destination. No CVE CNA title, no affected component name, and no code-level artifacts were supplied. Accordingly, this report describes the vulnerability at the class level and does not attribute the flaw to any specific MarkLogic API, module, or configuration surface. Analysts should treat the exact injection point as unidentified pending the vendor advisory.

The CVSS vector substantiates the class-level analysis. Attack Vector Network (AV:N) confirms remote reachability. Attack Complexity Low (AC:L) indicates no special preconditions or race conditions are required. Privileges Required Low (PR:L) is consistent with "an authenticated attacker" — ordinary application or database credentials, not administrative rights. User Interaction None (UI:N) means no victim must click or otherwise cooperate. Scope Changed (S:C) is the key signal: the vulnerable component can affect resources beyond its own security authority — here, the cloud IAM plane. Confidentiality High (C:H) reflects credential material and potentially data exposed through cloud APIs; Integrity Low (I:L) reflects the limited, non-arbitrary write potential implied by the description; Availability None (A:N) indicates no denial-of-service dimension is claimed.

Because the vulnerability is described but not functionally documented, defensive teams should not assume a single fixed payload shape. SSRF defenses that rely on a static deny-list of strings can typically be bypassed through redirects, DNS rebinding, alternate IP encodings, or non-standard URL schemes. Detection therefore must combine behavioral signals — outbound connections from MarkLogic to metadata or internal service ranges — with authorization telemetry on the affected cloud provider.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-85952. The attack chain below is inferred from the vulnerability class (CWE-918) and the CNA description, which explicitly describes the outcome rather than the mechanics. No specific function, endpoint, or parameter names are asserted because none were provided in the source data.

1. Reconnaissance and target identification. The attacker locates a Linux-based MarkLogic Server instance in the affected version ranges (12.x < 12.1.0, 11.x < 11.3.7) that is exposed to the network and hosted in a cloud environment. Fingerprinting is possible through MarkLogic's HTTP service banners, administrative interfaces, or default ports. Because PR:L is required, the attacker must also obtain valid credentials for the instance — through legitimate provisioning, a prior phishing or credential-stuffing operation, or reuse of leaked secrets — or abuse a separate access path that yields an authenticated session.

2. Triggering the SSRF. Once authenticated, the attacker submits input to whatever MarkLogic feature performs a server-side fetch of a caller-supplied target. The attacker supplies a crafted destination pointing at an internal service — canonically the cloud instance metadata endpoint or an internal credential service — rather than an external host. The MarkLogic process, running with network access to the instance's internal range, honors the request. Because the fetch is server-originated, it bypasses perimeter controls that restrict inbound access to metadata from outside the instance.

3. Payload/execution at the class level. The attacker's manipulated destination causes MarkLogic to issue an HTTP request to the internal endpoint. The response body — for example, an instance identity document containing temporary role credentials — is returned to the attacker through the same application path that returned the fetch result. Attackers may chain redirects or alternate address encodings (for example, alternate representations of the link-local address, or a DNS name resolving to it) to defeat naive URL filtering. No specific bypass technique can be attributed to this CVE from the available data.

4. Post-exploitation impact. With harvested cloud credentials, the attacker authenticates to the cloud provider's control plane and enumerates permissions associated with the MarkLogic instance's attached role or service account. Depending on that role's policy breadth, the attacker may read or exfiltrate data in cloud object storage, database services, or secrets managers, and may move laterally to other cloud workloads that trust the same role or account. This pivot — from an authenticated database user to cloud API principal — is precisely the Scope:Changed transition encoded in the CVSS vector.

Impact Assessment

The blast radius of CVE-2026-85952 is determined less by the MarkLogic instance itself than by the permissions of the cloud identity attached to its host. In a least-privilege deployment, the fallout is bounded; in typical enterprise deployments, MarkLogic instances often carry broad roles to reach backup buckets, logging sinks, secret stores, and downstream data services. The CVSS subscores map to the following business effects:

• Confidentiality: High (C:H) — credential disclosure and subsequent cloud enumeration can expose tenant data, backups, and secrets at scale.
• Integrity: Low (I:L) — the description emphasizes access and credential theft over arbitrary data modification, implying limited write impact, though credential theft frequently precedes destructive actions performed through legitimate cloud APIs.
• Availability: None (A:N) — no availability impact is claimed.
• Scope: Changed (S:C) — impact crosses from the vulnerable MarkLogic component into cloud IAM resources under a different security authority.
• Privileges Required: Low (PR:L) — any authenticated user, not only administrators, can mount the attack, which widens the internal threat surface to include low-privilege application accounts.

Multi-tenant MarkLogic deployments and those in regulated environments (financial services, healthcare) should treat this as high urgency: the affected asset is a data store, and the exploitation outcome is credential compromise. CISA KEV status is NO, and no exploit-in-the-wild evidence was provided, which lowers the immediate external urgency but does not eliminate risk from insider or credential-holding adversaries.

Detection Guidance

Detection strategy has two layers: identify outbound requests from MarkLogic hosts to internal or metadata ranges, and detect anomalous cloud API activity from the compromised instance role.

Sigma Rule

title: MarkLogic Server SSRF to Cloud Metadata Endpoint
id: 7f3a9c2e-1b64-4d8a-9e21-4c5f0a8b2d17
status: experimental
description: Detects outbound HTTP requests from MarkLogic processes to cloud instance metadata or internal credential services, consistent with CVE-2026-85952 SSRF exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85952
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/marklogic'
      - '/java'
    CommandLine|contains: 'MarkLogic'
  selection_dest:
    DestinationIp:
      - '169.254.169.254'
      - '169.254.170.2'
      - '100.100.100.200'
    DestinationPort: 80
  condition: selection_process and selection_dest
falsepositives:
  - Legitimate cloud SDK calls from MarkLogic for approved storage or backup operations
level: high
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_85952_MarkLogic_SSRF_Metadata
{
    meta:
        description = "Detects MarkLogic request/response artifacts referencing cloud metadata endpoints indicative of CVE-2026-85952 SSRF exploitation"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85952"
        date = "2026-01-01"
        severity = "high"

    strings:
        $md1 = "169.254.169.254" ascii wide
        $md2 = "169.254.170.2" ascii wide
        $md3 = "100.100.100.200" ascii wide
        $meta1 = "latest/meta-data/iam/security-credentials" ascii wide
        $meta2 = "metadata/identity/oauth2/token" ascii wide
        $srv = "MarkLogic" ascii wide

    condition:
        $srv and any of ($md*) or any of ($meta*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-85952 MarkLogic SSRF to Cloud Instance Metadata"; flow:established,to_server; http.host; content:"169.254.169.254"; http.uri; content:"/latest/meta-data/"; nocase; reference:cve,2026-85952; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85952; classtype:attempted-recon; sid:202685952; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-85952;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-85952 Cloud IAM Credentials Returned in Response"; flow:established,from_server; http.response_body; content:"AccessKeyId"; nocase; http.response_body; content:"SecretAccessKey"; nocase; reference:cve,2026-85952; classtype:attempted-recon; sid:202685953; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-85952;)

Elastic Detection

network where
  process.name in ("java", "java.exe", "marklogic") and
  destination.ip in ("169.254.169.254", "169.254.170.2", "100.100.100.200") and
  destination.port in (80, 443)

sequence by host.id with maxspan=30s
  [network where process.name in ("java","marklogic") and
     destination.ip in ("169.254.169.254","169.254.170.2","100.100.100.200")]
  [network where event.action == "connection_accepted" and
     network.bytes > 0 and
     process.name in ("java","marklogic")]

Splunk SPL Query

index=network (sourcetype=pan:traffic OR sourcetype=zeek:conn OR sourcetype=fortinet:utm)
dest_ip IN ("169.254.169.254","169.254.170.2","100.100.100.200")
source IN ("*marklogic*","*MarkLogic*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

index=marklogic OR index=cloudtrail
| search (uri="*meta-data*" OR uri="*security-credentials*" OR userAgent="*MarkLogic*")
| stats count values(uri) as requested_uris values(userAgent) as user_agents by src_ip, userIdentity.arn
| where count > 3

Wazuh OSSEC Rule

<group name="marklogic,ssrf,cve-2026-85952">
  <rule id="100952" level="12">
    <if_sid>100950</if_sid>
    <field name="dstip">169\.254\.169\.254|169\.254\.170\.2|100\.100\.100\.200</field>
    <description>CVE-2026-85952: MarkLogic server contacted cloud metadata endpoint (possible SSRF)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_918,pci_dss_6.5.1,</group>
  </rule>

  <rule id="100953" level="14">
    <if_sid>100952</if_sid>
    <field name="url">meta-data|security-credentials|oauth2/token</field>
    <description>CVE-2026-85952: MarkLogic SSRF request retrieved cloud IAM credential path</description>
    <mitre>
      <id>T1552.005</id>
    </mitre>
    <group>cwe_918,credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory identifier, workaround, or patch reference was provided in the source data. The following measures are class-appropriate mitigations for SSRF in a cloud-hosted MarkLogic deployment.

Immediate mitigations

1. Enforce IMDSv2 (session-token-required) on all cloud instances hosting MarkLogic. IMDSv2 requires a PUT request to obtain a token before metadata retrieval, which defeats simple GET-based SSRF. Prefer IMDSv2-only mode where the platform supports it.
2. Restrict the instance's attached IAM role to least privilege. Remove wildcard actions and broad resource scopes; scope access to specific buckets, tables, and secret paths the application actually needs. This bounds post-exploitation impact.
3. Apply egress network controls from the MarkLogic host. Block instance processes from reaching the metadata service and internal credential endpoints unless a documented dependency requires it, and deny egress to RFC1918 and link-local ranges by default.
4. Audit and reduce the number of authenticated accounts with access to the MarkLogic instance, since PR:L means any valid credential is sufficient to attempt exploitation. Investigate anomalous outbound fetches in MarkLogic application logs.

Patch/upgrade steps

1. Upgrade Linux-based MarkLogic Server 12.x instances to 12.1.0 or later, and 11.x instances to 11.3.7 or later. These are the fixed releases per the CNA description.
2. Verify the vendor advisory for the definitive fix, workaround, and any configuration guidance; no vendor advisory URL was supplied in the data provided and should be confirmed directly from Progress before rollout.
3. After upgrade, confirm the previously reachable internal endpoints are no longer fetchable from the application path and re-validate egress firewall rules.

Long-term hardening

1. Adopt outbound allow-listing for server-initiated requests: deny-by-default egress with explicit destination and port permits for required dependencies.
2. Monitor cloud control-plane activity for use of instance-role credentials from unexpected source IPs, with alerts on credential use from outside the instance's known egress addresses.
3. Rotate any credentials that may have been exposed prior to remediation, and treat pre-upgrade sessions as potentially compromised.
4. Integrate SSRF-resistant design review into application security gates for any feature that performs server-side fetches, including validation that resolved IPs fall within permitted ranges after DNS resolution.

References

1. NVD — CVE-2026-85952: https://nvd.nist.gov/vuln/detail/CVE-2026-85952
2. CWE-918, Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
3. MITRE ATT&CK T1190, Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. MITRE ATT&CK T1552.005, Unsecured Credentials: Cloud Instance Metadata API: https://attack.mitre.org/techniques/T1552/005/
5. Progress MarkLogic Server product documentation and security advisories: https://www.progress.com/marklogic

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-85952, and CISA KEV status is NO. No named threat actor campaigns or exploit-in-the-wild evidence were provided in the source data. EPSS has not yet scored this CVE; no EPSS value is asserted here.