CVE-2026-9203

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.

Score

CVSS 3.1 8.5 High

Status

Analyzed - security@progress.com

Published

2026-08-05

Last modified

2026-10-24

Weaknesses

CWE-918

Affected products

• Marklogic Server (Progress)
• Marklogic Server (Progress Software Corporation)

References

• https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026