CVE-2026-85952: CWE-918: Server-Side Request Forgery (SSRF) in Progress Software Corporation MarkLogic Server

CVE-2026-85952 is a server-side request forgery (SSRF) vulnerability identified in Progress Software Corporation's MarkLogic Server on Linux platforms. It affects versions 11.0.0 through 11.3.6 and 12.0.0 through 12.0.x prior to 12.1.0. The flaw allows an authenticated attacker to make crafted requests from the server to internal cloud services, which could lead to unauthorized access to sensitive cloud credentials. The vulnerability is rated high severity with a CVSS 3.1 score of 8.5, indicating network attack vector, low attack complexity, required privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An authenticated attacker exploiting this SSRF vulnerability can access internal cloud services that are normally inaccessible externally. This may result in unauthorized disclosure of cloud credentials, potentially compromising cloud resources. The integrity impact is limited, and availability is not affected.

A fix is available in MarkLogic Server versions 11.3.7 and 12.1.0 and later. Users should upgrade to these versions to remediate the vulnerability. Since this is not a cloud-hosted service, remediation depends on applying the official vendor patch. No indication of temporary mitigations or no-action advisories is provided, so patching is recommended.