CVE-2026-7329: MarkLogic Server Privilege Escalation Flaw

CVE-2026-7329 Overview

CVE-2026-7329 is an improper privilege management vulnerability [CWE-269] in Progress MarkLogic Server. The flaw affects the SQL, SPARQL, and Optic REST query interfaces in versions prior to 11.3.6 and 12.0.3. An authenticated user holding a low-privileged REST role can escalate to administrator privileges. Successful exploitation permits execution of privileged operations and unauthorized access to data stored in the database.

Critical Impact
An authenticated low-privileged REST user can escalate to administrator, gaining full control over database operations and stored data.

Affected Products

Progress MarkLogic Server versions prior to 11.3.6
Progress MarkLogic Server versions prior to 12.0.3
SQL, SPARQL, and Optic REST query interfaces

Discovery Timeline

2026-08-05 - CVE-2026-7329 published to NVD
2026-08-05 - Last updated in NVD database
August 2026 - Progress issues MarkLogic Critical Security Alert Bulletin

Technical Details for CVE-2026-7329

Vulnerability Analysis

The vulnerability resides in how MarkLogic Server enforces authorization within its REST-based query endpoints. The SQL, SPARQL, and Optic query interfaces accept authenticated requests but fail to properly constrain the executing role's privileges during query processing. This allows a caller possessing only a low-privileged REST role to invoke operations reserved for administrators.

The issue changes scope during exploitation, meaning code executed through the query interfaces impacts resources beyond the initially authorized security boundary. Attackers gain full read, write, and availability impact on the affected server. Because the interfaces are typically network-exposed for application integration, the attack can be launched remotely with minimal complexity.

Root Cause

The root cause is improper privilege management [CWE-269] within the query execution path of the REST interfaces. The server does not correctly evaluate whether the authenticated role is entitled to run privileged operations embedded in SQL, SPARQL, or Optic queries. Instead, requests are processed with effective privileges higher than the caller's assigned role.

Attack Vector

Exploitation requires an authenticated session with a low-privileged REST role. The attacker submits crafted queries to the SQL, SPARQL, or Optic REST endpoints that trigger administrative operations. Because privilege enforcement is bypassed at the query interface layer, the server executes these operations as if the caller held administrator rights. Refer to the Progress Security Alert Bulletin for vendor technical detail.

No public proof-of-concept exploit has been observed at the time of publication.

Detection Methods for CVE-2026-7329

Indicators of Compromise

Unexpected administrative operations logged from accounts holding only REST roles
Requests to /v1/rows, /v1/graphs/sparql, or SQL endpoints followed by privileged configuration or user-management activity
Creation of new users, roles, or privilege grants originating from low-privileged sessions
Bulk data extraction or schema enumeration from accounts not previously performing such actions

Detection Strategies

Audit MarkLogic access logs for query requests that immediately precede privileged API calls from the same session
Correlate REST authentication events with administrative endpoint invocations to identify role-privilege mismatches
Baseline normal query patterns per REST role and alert on deviations involving security or configuration namespaces
Monitor for SPARQL UPDATE or SQL DDL statements issued by accounts without those privileges

Monitoring Recommendations

Forward MarkLogic audit and access logs to a centralized SIEM for correlation with authentication events
Enable verbose logging on the SQL, SPARQL, and Optic REST interfaces until patches are applied
Track changes to security.xml role definitions and privilege grants in near real time
Alert on any successful administrator-level operation initiated through REST query endpoints

How to Mitigate CVE-2026-7329

Immediate Actions Required

Upgrade Progress MarkLogic Server to version 11.3.6, 12.0.3, or later without delay
Inventory all REST role assignments and remove unnecessary access to SQL, SPARQL, and Optic endpoints
Rotate credentials for any REST-role account that could have been abused prior to patching
Review audit logs for signs of privilege escalation activity dating back to the earliest affected deployment

Patch Information

Progress has released fixed builds in MarkLogic Server 11.3.6 and 12.0.3. Upgrade guidance and download links are available in the Progress MarkLogic Critical Security Alert Bulletin - August 2026.

Workarounds

Restrict network access to the MarkLogic REST query interfaces using firewall rules or reverse proxy allow-lists
Disable the SQL, SPARQL, and Optic REST endpoints on servers that do not require them until upgraded
Reduce the number of accounts holding any REST role to the minimum required for operations
Require strong authentication and short-lived sessions for all REST clients

bash

# Configuration example: restrict REST access at the network edge
# Replace <trusted_cidr> with your application tier's address range
iptables -A INPUT -p tcp --dport 8000 -s <trusted_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP

# Verify installed MarkLogic version meets the patched baseline
curl -u admin:<password> \
  http://localhost:8002/manage/v2/hosts?format=json \
  | jq '."host-default-list"."list-items"."list-item"[].version'