Critical MarkLogic Server Flaw CVE-2026-9191 Allows Session Hijacking

A critical vulnerability in Progress MarkLogic Server allows attackers to bypass security controls and compromise user sessions. The National Vulnerability Database records the flaw as CVE-2026-9191, assigning it a CVSS score of 9.6. This high severity rating indicates significant risk for organizations relying on these database systems for data management and application support.

The vulnerability stems from insufficient isolation of user-supplied code executed through specific REST and XDBC evaluation paths. According to the NVD record, the server fails to properly separate this code from HTTP request, response, and session state. An attacker who can execute code through these affected paths may perform unauthorized actions or take over an authenticated session without further credentials.

Technical Details of the Vulnerability

The core issue involves how MarkLogic Server handles code execution in certain interfaces. The NVD description notes that the server does not sufficiently isolate user-supplied code from the surrounding HTTP environment. This lack of isolation creates a bridge between the executed code and sensitive session data. Consequently, an attacker can manipulate session state or intercept responses during the evaluation process.

The weakness is classified under CWE-346 by the NVD. The source material lists this CWE ID but does not provide a textual definition of the weakness category. The flaw allows malicious input to influence the behavior of the server in ways that were not intended by the developers. This technical failure enables the compromise of authenticated sessions, which are typically considered secure after initial user verification.

Who Is Affected by This Flaw

Progress Software Corporation is the vendor responsible for the affected MarkLogic Server products. The vulnerability specifically impacts older releases of the software. Users running MarkLogic Server 12.x versions before 12.1.0 are exposed to this risk. Similarly, those using MarkLogic Server 11.x versions prior to 11.3.7 face the same potential for session hijacking and unauthorized action execution.

Organizations that have not updated to the specified patched versions remain vulnerable. The NVD record explicitly lists releases before 11.3.7 and before 12.1.0 as affected. Systems running these older versions do not have the necessary code isolation fixes. Administrators must verify their current version against these thresholds to determine their exposure level to CVE-2026-9191.

What should you do?

Administrators should immediately audit their MarkLogic Server installations to check version numbers. Identifying systems running versions before 12.1.0 or 11.3.7 is the first step in mitigation. Those on affected versions should prioritize updating to the latest secure releases provided by Progress Software Corporation. Until updates are applied, restricting access to REST and XDBC endpoints may reduce the attack surface.