CVE-2026-7326 Overview
CVE-2026-7326 is a cross-site request forgery (CSRF) vulnerability in the Admin UI of Progress MarkLogic Server. The flaw affects versions before 11.3.6 and 12.0.3. A remote attacker who lures an authenticated administrator to a malicious web page can trigger administrative actions on the administrator's behalf. Successful exploitation can lead to unauthorized changes to the server's security configuration. The weakness is classified under CWE-352: Cross-Site Request Forgery.
Critical Impact
An attacker can modify MarkLogic security configuration by tricking an authenticated administrator into visiting an attacker-controlled page, resulting in loss of confidentiality, integrity, and availability.
Affected Products
- Progress MarkLogic Server versions before 11.3.6
- Progress MarkLogic Server 12.x versions before 12.0.3
- MarkLogic Server Admin UI component
Discovery Timeline
- 2026-08-05 - CVE-2026-7326 published to NVD
- 2026-08-05 - Last updated in NVD database
- August 2026 - Progress publishes MarkLogic Critical Security Alert Bulletin
Technical Details for CVE-2026-7326
Vulnerability Analysis
The MarkLogic Admin UI accepts state-changing requests without verifying that the request originated from a legitimate administrator session. Because the Admin UI relies on ambient browser credentials, a browser holding an authenticated session will attach those credentials to any request the browser issues, including requests forged by a third-party site. An attacker can craft an HTML page that submits requests to the MarkLogic Admin UI endpoints. When a logged-in administrator loads that page, the browser transmits the forged request with valid session cookies. The server processes the request as if the administrator initiated it.
Root Cause
The root cause is missing or insufficient CSRF protection in the Admin UI request handling. The application does not validate an unpredictable per-request or per-session anti-CSRF token, and it does not sufficiently constrain requests using origin or referer checks. This allows cross-origin requests to reach privileged administrative handlers.
Attack Vector
Exploitation requires user interaction: an authenticated MarkLogic administrator must visit a malicious page or click a crafted link while their Admin UI session is active. The request is delivered over the network, and no attacker credentials are required. Once triggered, the attacker can invoke administrative operations exposed through the Admin UI, including changes to security configuration such as roles, users, or authentication settings. See the Progress Security Alert Bulletin for vendor-supplied technical detail.
Detection Methods for CVE-2026-7326
Indicators of Compromise
- Unexpected changes to MarkLogic roles, users, or permission grants in the security database.
- Admin UI requests whose Referer or Origin header points to an external or unknown domain.
- Administrative configuration changes recorded outside of scheduled change windows.
- New or modified authentication providers, external security configurations, or app-server security settings.
Detection Strategies
- Review MarkLogic audit logs for administrative endpoint invocations correlated with administrator browsing sessions.
- Alert on any state-changing HTTP request to Admin UI paths where Origin or Referer does not match the MarkLogic host.
- Baseline normal administrator activity and flag configuration changes that deviate from that baseline.
- Correlate proxy or web gateway logs with MarkLogic access logs to identify third-party pages preceding privileged requests.
Monitoring Recommendations
- Enable and centralize MarkLogic audit logging for security configuration changes, including role, user, and permission modifications.
- Forward MarkLogic access and audit logs to a SIEM or data lake for correlation with browser and proxy telemetry.
- Monitor administrator workstations for browsing activity to untrusted domains while Admin UI sessions are active.
- Track version and patch level of MarkLogic Server instances to identify hosts running vulnerable builds.
How to Mitigate CVE-2026-7326
Immediate Actions Required
- Upgrade MarkLogic Server to version 11.3.6, 12.0.3, or later as specified in the vendor bulletin.
- Require administrators to log out of the Admin UI when not performing administrative work.
- Restrict Admin UI network exposure to management networks or trusted jump hosts.
- Review recent security configuration changes for unauthorized modifications and revert any that cannot be attributed to legitimate activity.
Patch Information
Progress addressed CVE-2026-7326 in MarkLogic Server 11.3.6 and 12.0.3. Apply the fixed versions per the MarkLogic Critical Security Alert Bulletin – August 2026. Verify installed builds after upgrade and restart affected services.
Workarounds
- Limit Admin UI access to a dedicated administrative network segment or VPN, blocking direct access from user workstations that browse the internet.
- Use a separate browser profile or dedicated administrative workstation for MarkLogic Admin UI sessions.
- Enforce short session timeouts on the Admin UI so idle authenticated sessions cannot be leveraged by a forged request.
- Deploy an authenticating reverse proxy in front of the Admin UI that enforces Origin and Referer validation.
# Example: restrict MarkLogic Admin UI (default port 8001) to a management CIDR
# Adjust interface, source, and firewall syntax to your environment
iptables -A INPUT -p tcp --dport 8001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
