CVE-2026-9191: CWE-346: Origin Validation Error in Progress Software Corporation MarkLogic Server

Progress MarkLogic Server versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0 contain an origin validation error (CWE-346) where user-supplied code executed through specific REST and XDBC evaluation paths is not properly isolated from HTTP request, response, and session state. This vulnerability enables an attacker with code execution capability on these paths to potentially perform unauthorized actions or hijack authenticated sessions. The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

An attacker able to execute code through the affected REST or XDBC evaluation paths can perform unauthorized actions or compromise authenticated sessions, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system.

A fix is available in MarkLogic Server versions 11.3.7 and 12.1.0 and later. Users should upgrade to these versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or if no action is required.