CVE-2026-9190: MarkLogic Server Auth Bypass Vulnerability

CVE-2026-9190 Overview

CVE-2026-9190 is an HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server. The flaw affects MarkLogic Server versions before 11.3.6 and before 12.0.3. A remote attacker can bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability arises when a crafted HTTP request carrying both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently. The issue is tracked under [CWE-444] (Inconsistent Interpretation of HTTP Requests).

Critical Impact
Unauthenticated remote attackers can smuggle requests through reverse proxies to bypass authentication, hijack sessions, and capture credentials against MarkLogic HTTP App Servers.

Affected Products

Progress MarkLogic Server versions before 11.3.6
Progress MarkLogic Server 12.x versions before 12.0.3
MarkLogic HTTP App Server deployments fronted by a reverse proxy

Discovery Timeline

2026-08-05 - CVE-2026-9190 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database
August 2026 - Progress publishes the MarkLogic Critical Security Alert Bulletin

Technical Details for CVE-2026-9190

Vulnerability Analysis

HTTP request smuggling occurs when two HTTP processors on the same request path disagree about where one request ends and the next begins. In this case, a reverse proxy in front of MarkLogic Server and the MarkLogic HTTP App Server parse a single crafted request differently. Attackers exploit this desynchronization to prepend or append attacker-controlled data to a subsequent legitimate request. The result is authentication bypass, authorization bypass, session hijacking, and credential capture from users transiting the same proxy connection.

Root Cause

The root cause is inconsistent handling of requests that supply both Content-Length and Transfer-Encoding: chunked headers. RFC 7230 requires that when both headers appear, Transfer-Encoding takes precedence and Content-Length must be ignored or the request rejected. When the reverse proxy honors one header while MarkLogic Server honors the other, the servers frame the request stream differently. The trailing bytes of the attacker's payload are then treated as the start of the next request by the downstream server.

Attack Vector

The attack requires only network reachability to the reverse proxy fronting MarkLogic Server. No prior authentication or user interaction is needed. The attacker sends a single HTTP/1.1 request containing both framing headers with conflicting values, followed by a smuggled request body that targets an authenticated endpoint. The smuggled bytes execute in the context of the next pipelined user, allowing the attacker to hijack that user's session or read their submitted credentials.

See the Progress Security Alert Bulletin for vendor technical details. No public proof-of-concept code has been verified for this CVE.

Detection Methods for CVE-2026-9190

Indicators of Compromise

HTTP requests to the MarkLogic HTTP App Server containing both Content-Length and Transfer-Encoding: chunked headers
Unexpected requests appearing in App Server logs that were not sent by legitimate upstream clients
Session activity for authenticated users originating from IP addresses that never authenticated
Reverse proxy access logs showing requests with malformed or duplicated framing headers

Detection Strategies

Inspect proxy and MarkLogic App Server logs for requests with conflicting framing headers and reject or alert on them at the edge
Correlate reverse proxy request counts against MarkLogic App Server request counts; smuggling produces asymmetric counts
Alert on abrupt session identifier changes for a single client IP or on session use from geographies inconsistent with prior activity

Monitoring Recommendations

Enable verbose HTTP request logging on both the reverse proxy tier and the MarkLogic HTTP App Server for diff analysis
Monitor for authentication events, credential submission endpoints, and privilege changes occurring in unusual sequences
Retain full request headers, not just request lines, so header-framing anomalies remain investigable after the fact

How to Mitigate CVE-2026-9190

Immediate Actions Required

Upgrade MarkLogic Server to version 11.3.6, 12.0.3, or later per the Progress August 2026 security bulletin
Inventory all MarkLogic HTTP App Server instances that sit behind a reverse proxy and prioritize those exposed to untrusted networks
Configure the fronting reverse proxy to reject any request that presents both Content-Length and Transfer-Encoding headers
Rotate credentials and session tokens that may have transited a vulnerable proxy path

Patch Information

Progress has released fixed versions MarkLogic Server 11.3.6 and 12.0.3. Details are published in the MarkLogic Critical Security Alert Bulletin - August 2026. Apply the vendor patch as the primary remediation.

Workarounds

Terminate HTTP/1.1 keep-alive connections between the reverse proxy and MarkLogic Server, forcing a fresh connection per request
Deploy a Web Application Firewall (WAF) rule that drops requests containing both Content-Length and Transfer-Encoding: chunked
Restrict network access to the MarkLogic HTTP App Server to trusted proxy source addresses only

bash

# Example NGINX hardening: reject requests with conflicting framing headers
# Place inside the server{} block fronting MarkLogic Server
if ($http_transfer_encoding ~* "chunked") {
    if ($http_content_length) {
        return 400;
    }
}
proxy_http_version 1.1;
proxy_set_header Connection "close";