CVE-2026-7557: MarkLogic Server Auth Bypass Vulnerability

CVE-2026-7557 Overview

CVE-2026-7557 is an improper verification of cryptographic signature vulnerability [CWE-347] in the Security Assertion Markup Language (SAML) authentication module of Progress MarkLogic Server. The flaw affects MarkLogic Server versions before 11.3.6 and 12.0.3 when SAML single sign-on (SSO) is enabled. An unauthenticated remote attacker can bypass authentication and impersonate any user, including administrators. Progress documented the issue in the August 2026 security alert bulletin.

Critical Impact
Remote attackers can forge SAML assertions to authenticate as any user, including database administrators, without credentials.

Affected Products

Progress MarkLogic Server versions prior to 11.3.6
Progress MarkLogic Server 12.x versions prior to 12.0.3
MarkLogic deployments with SAML single sign-on enabled

Discovery Timeline

2026-08-05 - CVE-2026-7557 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-7557

Vulnerability Analysis

The vulnerability resides in the SAML authentication module of MarkLogic Server. The module fails to properly verify the cryptographic signature on inbound SAML assertions. SAML assertions are signed XML documents that attest to a user's identity after authentication at an identity provider. When a service provider such as MarkLogic accepts a signed assertion, it must validate the signature against a trusted signing certificate before trusting the identity claims inside.

Because MarkLogic performs the signature check incorrectly, an attacker can submit a crafted SAML response that MarkLogic accepts as valid. The attacker controls the Subject and NameID fields in the forged assertion. This lets the attacker assert any username, including built-in administrator accounts. The result is a full authentication bypass across the network attack surface with no prior credentials or user interaction required.

Root Cause

The root cause is an improper implementation of XML digital signature verification within the SAML consumer. Common patterns behind [CWE-347] failures include accepting unsigned assertions, trusting signatures over attacker-controlled elements, ignoring the certificate chain, or failing to bind the signature to the asserted subject. Progress has not published the precise defect class in public references.

Attack Vector

Attack traffic reaches the MarkLogic SAML Assertion Consumer Service (ACS) endpoint over the network. The attacker crafts a SAML response naming a privileged user and submits it to the ACS URL. MarkLogic returns an authenticated session bound to the impersonated identity. From there, the attacker can read, write, and administer data stored in MarkLogic.

No verified proof-of-concept code has been published. Refer to the Progress Security Alert Bulletin for vendor technical details.

Detection Methods for CVE-2026-7557

Indicators of Compromise

SAML responses received by the MarkLogic ACS endpoint containing signatures that reference elements outside the signed scope or that use unexpected certificate issuers.
Successful authentication events for administrative accounts originating from IP addresses not associated with the identity provider.
Session creation for privileged users without a corresponding authentication event at the upstream identity provider log.

Detection Strategies

Compare MarkLogic authentication logs against identity provider logs to identify sessions with no matching upstream login.
Inspect SAML responses at the network layer for anomalies such as duplicate Assertion elements, wrapped signatures, or unexpected Issuer values.
Alert on new administrator logins from previously unseen source addresses or user agents.

Monitoring Recommendations

Forward MarkLogic audit logs and web access logs to a centralized SIEM for correlation with identity provider telemetry.
Track failed and successful SAML authentications per source IP and per asserted user to baseline normal behavior.
Monitor administrative operations such as role changes, user creation, and data export following any SAML authentication event.

How to Mitigate CVE-2026-7557

Immediate Actions Required

Upgrade MarkLogic Server to version 11.3.6, 12.0.3, or later as specified by Progress.
If patching is not immediately possible, disable SAML single sign-on and fail over to an alternative authentication method.
Rotate credentials and review audit logs for any administrative activity that cannot be tied to a legitimate identity provider login.

Patch Information

Progress released fixed builds 11.3.6 and 12.0.3 that address the SAML signature verification defect. Details are published in the Progress Security Alert Bulletin. Apply the patch to every MarkLogic node in the cluster and restart affected services.

Workarounds

Disable the SAML authentication scheme on MarkLogic app servers and switch to internal, LDAP, or Kerberos authentication until the patch is applied.
Restrict network access to MarkLogic ACS endpoints so that only the trusted identity provider or a reverse proxy can reach them.
Enforce mutual TLS between the identity provider and MarkLogic to reduce the exposure of the ACS endpoint to unauthenticated clients.

bash

# Configuration example: restrict ACS endpoint to identity provider IPs
# Example nginx snippet in front of MarkLogic
location /saml/acs {
    allow 203.0.113.10;   # identity provider egress IP
    deny  all;
    proxy_pass https://marklogic-backend:8000;
}