CVE-2026-9191

Executive Summary

CVE-2026-9191 is a critical isolation failure in Progress MarkLogic Server affecting 12.x releases before 12.1.0 and 11.x releases before 11.3.7. The product does not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state, allowing an attacker who can execute code through an affected path to perform unauthorized actions or compromise an authenticated session. The vulnerability is network-reachable, requires user interaction per the CVSS vector, and carries a 9.6 base score with high confidentiality, integrity, and availability impact under a changed scope.

Technical Analysis

The root cause is classified as CWE-346: Origin Validation Error. In the MarkLogic context described by the NVD, the platform permits user-supplied code to be executed through certain REST and XDBC evaluation paths. The defect is that this execution environment is not sufficiently isolated from the HTTP request object, the HTTP response object, and session state.

This is a sandbox/isolation-boundary failure rather than a memory-corruption or injection flaw. The security property that breaks is separation of trust domains: code that should execute in a constrained evaluation context instead retains visibility into, and potentially control over, transport-layer and session-layer objects that belong to the hosting request. Because the evaluation paths are exposed via MarkLogic's REST and XDBC interfaces, the affected surface is the network-facing query/evaluation API rather than a local-only interface.

Two properties make this unusually severe even though it is not remote code execution in the classic sense:

1. The CVSS vector indicates Scope is Changed (S:C). The vulnerable evaluation component, once abused, can affect resources beyond its intended security authority — including the enclosing HTTP transaction and the authenticated session that owns it.
2. The vector indicates PR:N with UI:R. No privileges are required, but the victim user must be induced to interact with attacker-influenced content so that the attacker's code is evaluated within the victim's request/session context. This is consistent with a cross-user or cross-session interference pattern: the attacker does not need their own valid account privileges, but needs code to run inside a session that is worth compromising.

The C:H/I:H/A:H subscores reflect that a successful compromise of request, response, and session state can expose data returned to the victim, alter what the victim receives, and disrupt the session or service. The specific internal variables, objects, API methods, and code paths involved are not enumerated in the available NVD description; no function names, class names, or parameter names beyond the terms "REST" and "XDBC" are stated, and none should be assumed.

No public proof-of-concept, exploit code, or Nuclei template is known. No CISA KEV listing exists and no EPSS score has been published. Patch confidence is 0/4: no vendor advisory, commit, or patch artifact has been confirmed by tracked sources, so the 11.3.7 / 12.1.0 thresholds should be treated as the boundary stated in the NVD description and independently verified against the vendor's release notes before relying on them.

Exploitation Scenarios

No public PoC is available; the following chain is inferred strictly from the vulnerability class (CWE-346 isolation/origin-validation failure) and the affected paths named in the NVD description (REST and XDBC evaluation paths). No specific endpoints, functions, or payload strings are asserted, because none are provided.

1. Reconnaissance and target identification. The attacker locates internet- or intranet-exposed MarkLogic Server instances. Exposed REST and XDBC service ports are the identifying surface. Version fingerprinting against the 11.x and 12.x branches establishes whether the instance falls before the 11.3.7 / 12.1.0 boundaries. No authentication is required for the attack itself (PR:N), but the attacker must identify a path through which user-supplied code can be evaluated in the context of a request they can influence.

2. Triggering the flaw class. The attacker submits user-supplied code to an affected REST or XDBC evaluation path. Because the evaluation environment is not adequately isolated from HTTP request, response, and session state, the evaluated code is not confined to the intended sandbox. The isolation failure itself is the trigger — the attacker does not need to defeat a cryptographic control or forge an origin check; the control is simply absent or insufficient on these paths.

3. Execution within the victim context. Per the UI:R component, exploitation in the session-compromise variant requires the victim to interact with attacker-influenced content so that the code is evaluated while the victim's authenticated session is the active context. Once evaluated, the code can reach request, response, and session objects that should have been out of scope.

4. Post-exploitation impact. With access to request/response state, the attacker can read data surfaced to the victim and manipulate responses the victim receives. With access to session state, the attacker can act within the victim's authenticated session, effectively performing unauthorized actions as that user and potentially hijacking the session. Because scope is changed, effects can extend to resources and transactions beyond the originally invoked evaluation component.

The unauthenticated-request and victim-interaction variants may be chained: the attacker's initial code execution establishes the primitive, and the victim's interaction with affected content completes the session compromise.

Impact Assessment

Confidentiality: High — request and response state reachable from user-supplied code can expose data intended only for the owning session. Integrity: High — response and session state can be altered, enabling unauthorized actions in the victim's authenticated context. Availability: High — session disruption and, potentially, service-level impact are consistent with a full compromise of the enclosing transaction. Scope is Changed, indicating the exploited component can affect resources under a different security authority than its own.

Blast radius is determined by exposure of MarkLogic REST and XDBC interfaces. Any organization running an affected 11.x or 12.x release with these interfaces reachable by untrusted clients should treat its instance as at risk, including internal deployments where an attacker can reach the service via lateral movement or SSRF. Because the attack requires no privileges but does require user interaction, the highest-risk deployments are those where authenticated users routinely interact with content influenced by other parties or by external data sources, and multi-tenant or shared instances where one user's code execution primitive can reach another user's session.

Business impact centers on data disclosure from the database platform and on session integrity for privileged administrative or application users. A compromised administrative session on a MarkLogic cluster can translate directly into full control of the data platform. CVSS 9.6 places this in the critical band; the absence of public exploitation does not reduce urgency for internet-exposed instances, given the network attack vector and the changed-scope, high-impact subscores.

Detection Guidance

Detection must focus on the two observable classes of evidence: (a) anomalous use of REST/XDBC evaluation paths, and (b) signs that evaluated code is interacting with request, response, or session objects it should not reach. Because no PoC exists, the rules below target the general pattern rather than a known payload signature.

Sigma Rule

title: Suspected MarkLogic REST/XDBC Code Evaluation Isolation Bypass (CVE-2026-9191)
id: 3f9c2a71-8d4e-4b16-9a0f-7c1e5b2d9a44
status: experimental
description: Detects access to MarkLogic REST or XDBC evaluation paths that may indicate abuse of insufficient isolation between user-supplied code and HTTP/session state (CVE-2026-9191).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-9191
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: marklogic
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/v1/eval'
      - '/eval'
      - '/xdmp'
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_client:
    c-ip|notin:
      - '127.0.0.1'
  condition: selection_path and selection_method and selection_client
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
  - sc-status
falsepositives:
  - Legitimate application integrations that use evaluation endpoints
  - Internal automation and ETL jobs
level: high

YARA Rule

rule CVE_2026_9191_MarkLogic_Eval_Isolation_Abuse
{
    meta:
        description = "Detects request artifacts targeting MarkLogic REST/XDBC evaluation paths associated with CVE-2026-9191"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-9191"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $eval1 = "/v1/eval" ascii nocase
        $eval2 = "/eval" ascii nocase
        $xdbc = "XDBC" ascii nocase
        $rest = "MarkLogic" ascii nocase
        $sess = "session" ascii nocase
        $req  = "request" ascii nocase
        $resp = "response" ascii nocase

    condition:
        filesize < 2MB and
        (
            (any of ($eval*)) and $rest
        ) or
        (
            $xdbc and any of ($sess, $req, $resp) and $rest
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-9191 MarkLogic REST/XDBC code evaluation isolation bypass attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/eval"; nocase; http.request_body; content:"request"; nocase; http.request_body; content:"session"; nocase; reference:cve,2026-9191; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-9191; classtype:web-application-attack; sid:20269191; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [ network where network.protocol == "http" and
      http.request.method == "POST" and
      http.request.body.content : ("/eval" or "xdmp") and
      not source.ip : "127.0.0.1" ]
  [ network where network.protocol == "http" and
      http.response.status_code == 200 and
      http.request.body.content : ("request" and "session") ]

Splunk SPL Query

index=web OR index=marklogic
| search (uri_path="*/eval*" OR uri_path="*/xdmp*" OR uri_path="*/v1/eval*")
| eval suspicious=if(match(_raw,"(?i)(request|response|session)") AND method IN ("POST","PUT"),1,0)
| where suspicious=1 AND NOT c_ip IN ("127.0.0.1","::1")
| stats count min(_time) AS first_seen max(_time) AS last_seen values(uri_path) AS paths values(method) AS methods by src_ip, dest_host
| where count > 3
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="marklogic,web,cve-2026-9191,">
  <rule id="202691" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\/eval|\/xdmp|\/v1\/eval</field>
    <field name="method">POST|PUT</field>
    <description>CVE-2026-9191: Possible MarkLogic REST/XDBC evaluation path abuse - access to user-code evaluation endpoint from non-local client</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="202692" level="10">
    <if_sid>202691</if_sid>
    <field name="body">request|response|session</field>
    <description>CVE-2026-9191: MarkLogic evaluation request referencing HTTP/session state objects - possible isolation bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4. No vendor advisory, release-note entry, commit, or patch artifact for CVE-2026-9191 has been confirmed by any tracked source. The 11.3.7 and 12.1.0 boundaries are taken from the NVD description and must be independently verified. Do not assume the flaw is remediated until the vendor confirms current fixed versions.

1. Immediate mitigations.

• Verify the installed MarkLogic Server version. Any 11.x release below 11.3.7 or 12.x release below 12.1.0 falls within the described affected range.
• Restrict network access to REST and XDBC evaluation interfaces to trusted application tiers and administrative networks only. Block direct access from untrusted clients, including through reverse proxies and API gateways, using allowlists rather than denylists.
• Where deployment design permits, disable or tightly gate user-supplied code evaluation through REST and XDBC paths for untrusted users; require authentication and authorization on every evaluation endpoint.
• Terminate and rotate authenticated sessions and administrative credentials if compromise is suspected. Because request, response, and session state may be reachable from evaluated code, any session on an at-risk instance must be considered potentially exposed.
• Monitor and rate-limit requests to evaluation paths from non-local sources; treat repeated or malformed evaluation requests as hostile.

2. Patch/upgrade steps.

• Once the vendor publishes a confirmed fixed release, upgrade to MarkLogic Server 11.3.7 or 12.1.0, or a later release in the applicable branch, whichever the vendor states as remediated.
• Validate the vendor's release notes and security advisory for this CVE before relying on the version boundary; where the vendor names a later fixed version, that supersedes the NVD-stated boundary.
• Stage the upgrade in a non-production cluster first, confirming that application integrations using REST and XDBC evaluation paths continue to function after the isolation fix.

3. Long-term hardening.

• Enforce strict network segmentation between application tiers and the MarkLogic data tier; never expose administrative or evaluation interfaces directly to the internet.
• Adopt a robust software bill of materials and vulnerability-monitoring pipeline so MarkLogic versions are inventoried on every node of the cluster, not just the first node discovered.
• Treat user-code evaluation endpoints as high-risk and apply the principle of least authority: no evaluation path should have access to transport or session objects outside its own request context.
• Require step-up or re-authentication for administrative sessions, and alert on any unusual session behavior such as anomalous object access or geographic identity changes during a session.

References

1. NVD — CVE-2026-9191: https://nvd.nist.gov/vuln/detail/CVE-2026-9191
2. MITRE CWE-346 — Origin Validation Error: https://cwe.mitre.org/data/definitions/346.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Progress MarkLogic Server product documentation and security advisories portal: verify the current fixed release and vendor guidance for the 11.x and 12.x branches before acting on the NVD-stated 11.3.7 / 12.1.0 boundaries.
5. CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — as of the data available for this report, CVE-2026-9191 is NOT listed in CISA KEV. No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template are known for this CVE.