EUVD-2026-53431
GHSA-vc8h-qc29-hjr2
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable SSRF requiring low-privileged auth (PR:L); AC:H reflects non-trivial bypass of existing IMDS guards; S:C and C/I/A:H reflect full cloud environment compromise via stolen credentials.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.
AnalysisAI
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged users to bypass existing IMDS protection filters, causing the server to fetch cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). Successful exploitation yields temporary cloud IAM credentials, extending attacker reach to all cloud resources accessible by the host instance's IAM role. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated MarkLogic session with at minimum a low-privileged role (confirmed by CVSS PR:L); unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H scores 8.5 (High) and is internally consistent with the described vulnerability: network-reachable, requiring a low-privileged account, with high complexity due to the bypass of existing IMDS protections, and a scope change reflecting cloud environment impact beyond the MarkLogic process itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged MarkLogic account crafts a URL-fetching request using the specific bypass technique that circumvents MarkLogic's existing IMDS filter, causing the MarkLogic process to retrieve http://169.254.169.254/latest/meta-data/iam/security-credentials/ and return the response to the attacker. The attacker extracts the temporary AWS access key, secret, and session token from the response, then authenticates directly to the AWS API to enumerate and exfiltrate data from S3 buckets, RDS instances, or other resources accessible to the host's IAM role. |
| Remediation | Vendor-released patch: upgrade to MarkLogic Server 11.3.6 or 12.0.3 per the Progress community advisory at https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Progress MarkLogic Server deployments in cloud environments and document versions (impacted: pre-11.3.6 for version 11 line, pre-12.0.3 for version 12 line). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Marklogic Server
View allPrivilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user h
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigge
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today