CVE-2026-85976

Executive Summary

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 insufficiently sanitize input consumed by the Query Console file-exploration endpoint, enabling HTTP response splitting (CWE-113) and unintended client-side response handling. An authenticated user with low privileges can inject CRLF sequences that are reflected into response headers, potentially altering how downstream clients interpret the response. The CVSS base score is 5.4 (Medium), reflecting a network-reachable, low-privilege, user-interaction-dependent flaw with partial confidentiality and integrity impact scoped beyond the vulnerable component.

Technical Analysis

The vulnerability class here is HTTP response splitting, mapped to CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers, a.k.a. "HTTP Request/Response Splitting"). The root cause is that the Query Console file-exploration endpoint does not adequately sanitize user-supplied input before that input is used in the construction of an HTTP response. When input containing carriage-return/line-feed (CRLF) sequences or equivalent delimiters reaches the response-construction path, an attacker can inject additional header lines or an early header terminator. This can manifest as arbitrary response-header injection, response body splitting, or cache/keying anomalies depending on how the client and any intermediary parse the response.

Key technical observations, delimited strictly to what the advisory states:

• Attack surface: The Query Console file-exploration endpoint of MarkLogic Server. This is a web-reachable management/query interface. It is not described as available without authentication; the CVSS vector indicates PR:L (low privileges required), so an authenticated low-privileged operator is the presumed attacker position.
• Injection point: Input consumed by the file-exploration endpoint that is subsequently used in HTTP response generation. The advisory does not name the specific parameter, path, or method, so no specific parameter names, function names, or API paths can be asserted. Only the endpoint's general purpose (file exploration) is known.
• Impact mechanism: "HTTP response splitting and unintended client-side response handling." Response splitting classically enables header injection (e.g., Set-Cookie, Location, Content-Type modification), response body framing manipulation, and — where a shared cache or intermediary sits in front — cache poisoning. "Unintended client-side response handling" indicates the injected material changes how the browser or client processes the returned response.
• Scope: CVSS S:C indicates the impact crosses a security authority boundary, consistent with injected content being interpreted by a client or intermediary outside the MarkLogic component itself.
• Affected versions: MarkLogic Server 12.x releases prior to 12.1.0, and 11.x releases prior to 11.3.7.

No public proof-of-concept, exploit code, or Nuclei template is available as of this report. The precise input shape that reaches the vulnerable response-construction code cannot be stated from the provided advisory, and no implementation-level details (parameter names, function names, exact request paths) are asserted here. Technical detail beyond the above is not available.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the vulnerability class (HTTP response splitting) and the advisory's stated attack surface. It does not rely on any invented parameter or endpoint names.

1. Reconnaissance / target identification. An attacker identifies internet- or intranet-exposed MarkLogic instances by fingerprinting the MarkLogic Server and Query Console interface (consistent with the Shodan dorks above). The attacker determines whether they hold — or can obtain — low-privileged authenticated access, since PR:L is required.

2. Triggering the flaw class. The attacker authenticates at a low-privilege level and submits input to the file-exploration endpoint of Query Console. The input is crafted to carry CRLF (or equivalent line-terminator) sequences such that, when reflected into the HTTP response, it produces extra headers or a premature header/body boundary. The specific parameter is not identified in the advisory.

3. Payload / execution at the class level. Because this is CWE-113, the injected material is not code executed on the server; it manipulates the response stream. Typical outcomes of successful HTTP response splitting are: injection of attacker-controlled response headers, injection of content into the response body, and manipulation of response framing so a client displays or acts on attacker-supplied content. The "unintended client-side response handling" phrase describes the client consuming this malformed response.

4. Post-exploitation impact. Depending on the deployment, the injected/split response can influence client-side behavior (e.g., redirect, content substitution, cookie/header manipulation) and, if a caching intermediary is present, can poison cached responses served to other users. CVSS scored impact is partial confidentiality and partial integrity (C:L/I:L), with no availability impact (A:N), and requires user interaction (UI:R).

Impact Assessment

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N — base score 5.4 (Medium).

• AV:N / AC:L: Remotely reachable with no unusual preconditions beyond the network path; exploitation complexity is low once valid low-privileged access exists.
• PR:L: Requires an authenticated low-privileged account — this reduces the unauthenticated attacker population but is meaningful in environments where low-privilege accounts are readily provisioned or shared.
• UI:R: Some user (victim) must interact with the manipulated response, limiting automated mass exploitation.
• S:C: The injected content is interpreted by a component outside MarkLogic (a client and/or intermediary), so impact crosses an authority boundary.
• C:L / I:L: Partial confidentiality and partial integrity impact — consistent with header/response manipulation and possible cache poisoning rather than direct data exfiltration or code execution.
• A:N: No availability impact.

Business impact. MarkLogic is commonly deployed as a mission-critical NoSQL/enterprise data platform. Even a Medium-severity response-splitting flaw in its Query Console can be leveraged for client-side manipulation, session/header tampering, and cache poisoning on shared infrastructure. Blast radius is bounded by the need for a low-privileged account and victim interaction, but any shared caching layer in front of MarkLogic amplifies the number of affected users. Internet-exposed Query Console instances represent the highest-risk deployments.

EPSS: Not yet scored by FIRST.org. CISA KEV: Not listed — no confirmed in-the-wild exploitation.

Detection Guidance

Sigma Rule

title: MarkLogic Query Console Response Splitting Attempt (CRLF Injection)
id: 9f3c1a74-5e2b-4d88-a1c6-7b0e9f2d3c41
status: experimental
description: Detects CRLF/header-injection patterns directed at the MarkLogic Query Console file-exploration endpoint, consistent with CWE-113 HTTP response splitting.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85976
author: SOC Detection Engineering
date: 2026/01/01
tags:
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri|contains:
      - '/qconsole'
  selection_crlf:
    cs-uri-query|contains:
      - '%0d%0a'
      - '%0D%0A'
      - '\r\n'
      - '%0a%0d'
      - '%23%0d%0a'
  condition: selection_endpoint and selection_crlf
falsepositives:
  - Legitimate tooling that URL-encodes line breaks in file paths
level: high

YARA Rule

rule CVE_2026_85976_MarkLogic_CRLF_ResponseSplitting
{
    meta:
        description = "Detects CRLF/response-splitting payload artifacts targeting MarkLogic Query Console (CVE-2026-85976, CWE-113)"
        author = "SOC Detection Engineering"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85976"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ep1 = "/qconsole" ascii nocase
        $ep2 = "file-exploration" ascii nocase
        $crlf1 = "%0d%0a" ascii nocase
        $crlf2 = "%0D%0A" ascii
        $crlf3 = "\r\nSet-Cookie" ascii nocase
        $crlf4 = "\r\nLocation:" ascii nocase

    condition:
        ($ep1 or $ep2) and any of ($crlf*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85976 MarkLogic Query Console HTTP Response Splitting Attempt"; flow:established,to_server; http.uri; content:"/qconsole"; nocase; http.uri; content:"%0d%0a"; nocase; classtype:web-application-attack; reference:cve,2026-85976; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85976; sid:2026859760; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where network.protocol == "http" and url.path contains "/qconsole" ]
  [ network where network.protocol == "http" and (url.query contains "%0d%0a" or url.query contains "%0D%0A") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=marklogic:access
| eval uri_lower = lower(uri)
| where like(uri_lower, "%/qconsole%") AND (like(uri_lower, "%0d%0a%") OR like(uri_lower, "%0a%0d%") OR like(uri_lower, "%0d%0aset-cookie%"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as attempted_uris by src_ip
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,marklogic,cve-2026-85976,">
  <rule id="100976" level="10">
    <if_sid>31100</if_sid>
    <id>^GET|^POST</id>
    <url>/qconsole</url>
    <match>%0d%0a|%0D%0A|%0a%0d</match>
    <description>CVE-2026-85976: Possible HTTP response splitting (CRLF injection) attempt against MarkLogic Query Console file-exploration endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85976,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory references fixed releases but no tracked patch artifacts exist in the provided data.

1. Immediate mitigations (until upgrade is validated/available):

   • Restrict network access to the Query Console interface. Do not expose Query Console directly to untrusted networks; place it behind a hardened reverse proxy or VPN and enforce IP allow-listing.
   • Ensure only trusted, necessary accounts can reach the file-exploration endpoint; audit and reduce the population of low-privileged accounts with Query Console access (the vector requires PR:L).
   • Deploy a reverse proxy or WAF that rejects or normalizes CRLF sequences (%0d, %0a, and encoded variants) in request parameters, and configure intermediaries to strip or reject malformed response headers.
   • Disable or segregate shared caching layers in front of MarkLogic to limit any cache-poisoning blast radius.
   • Enable detailed web access and query-audit logging, and forward to the SIEM with the detections above.

2. Patch/upgrade steps:

   • The advisory specifies fixed versions: upgrade to MarkLogic Server 12.1.0 (for 12.x deployments) or 11.3.7 (for 11.x deployments). Verify the fix in a staging environment before production rollout.
   • Because no vendor patch artifact is present in tracked sources here, confirm availability and specifics directly from Progress before scheduling production changes.
   • After upgrade, re-test the file-exploration endpoint with CRLF-bearing input to confirm neutralization.

3. Long-term hardening:

   • Adopt a policy of input validation and output encoding for all HTTP-header construction, and standardize on frameworks that reject CRLF in header values by default.
   • Maintain a routine patch-management cadence for MarkLogic and treat the Query Console as an administrative interface subject to least privilege and network segmentation.
   • Add regression tests for CWE-113 (CRLF/header injection) into the SDLC for custom integrations built atop Query Console endpoints.

References

• NVD — CVE-2026-85976: https://nvd.nist.gov/vuln/detail/CVE-2026-85976
• CWE-113 — Improper Neutralization of CRLF Sequences in HTTP Headers: https://cwe.mitre.org/data/definitions/113.html
• Progress MarkLogic Server release/security guidance: https://www.progress.com/marklogic
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploit-in-the-wild evidence: None. CISA KEV status is NO; EPSS is not yet scored by FIRST.org; no public proof-of-concept, exploit code, or Nuclei template is available as of this report.