CVE-2026-9192: MarkLogic Server Auth Bypass Vulnerability

CVE-2026-9192 Overview

CVE-2026-9192 is an authentication bypass vulnerability in the Open Database Connectivity (ODBC) App Server of Progress MarkLogic Server. The flaw allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators. Affected versions are Progress MarkLogic Server prior to 11.3.6 and prior to 12.0.3. The vulnerability is classified under [CWE-287: Improper Authentication] and is network-exploitable without user interaction. Successful exploitation grants full read, write, and administrative access to MarkLogic data and functions.

Critical Impact
Unauthenticated remote attackers can impersonate any known user, including administrators, and execute arbitrary queries against MarkLogic Server.

Affected Products

Progress MarkLogic Server versions prior to 11.3.6
Progress MarkLogic Server versions prior to 12.0.3
ODBC App Server component of Progress MarkLogic Server

Discovery Timeline

2026-08-05 - CVE-2026-9192 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database
August 2026 - Progress publishes the MarkLogic Critical Security Alert Bulletin

Technical Details for CVE-2026-9192

Vulnerability Analysis

The vulnerability resides in the ODBC App Server component of Progress MarkLogic Server. This component exposes MarkLogic databases to clients using the PostgreSQL wire protocol, which MarkLogic implements to support ODBC connectivity. The authentication handler fails to correctly verify supplied credentials against the server's user store. An attacker can submit an authentication request specifying any valid username and bypass the password check entirely. Once authenticated, the attacker inherits the full privileges of the impersonated account. When the attacker specifies an administrator account, the session gains complete control over the database instance, including query execution, data modification, and configuration changes.

Root Cause

The root cause is improper authentication logic [CWE-287] in the ODBC App Server's credential validation path. The server accepts client-supplied identity claims without enforcing a correct password verification step. This design or implementation defect means the trust boundary between unauthenticated network clients and privileged database sessions is not enforced.

Attack Vector

Exploitation requires network reachability to the MarkLogic ODBC App Server port. No prior credentials, user interaction, or elevated privileges are needed. An attacker connects to the ODBC listener, initiates the PostgreSQL-style authentication handshake, and specifies the target username. Because password verification is bypassed, the server establishes a privileged session. The attacker then issues arbitrary queries using the impersonated account's rights.

No verified public proof-of-concept code is available. For technical detail, refer to the Progress MarkLogic Critical Security Alert Bulletin.

Detection Methods for CVE-2026-9192

Indicators of Compromise

Successful ODBC App Server authentication events for privileged accounts originating from unexpected source IP addresses or subnets.
MarkLogic audit log entries showing administrator-level query execution outside normal maintenance windows.
New or unusual ODBC session establishment against MarkLogic listener ports from external or untrusted networks.

Detection Strategies

Enable MarkLogic audit logging for authentication events and privileged query activity, then centralize logs for analysis.
Baseline expected ODBC client sources and alert on connections from IP addresses that fall outside the approved list.
Correlate MarkLogic authentication success events with corresponding network flow records to identify sessions lacking a legitimate credential exchange pattern.

Monitoring Recommendations

Monitor MarkLogic ODBC listener ports (default 5432-range TCP ports as configured per App Server) for unexpected inbound connections.
Track query volume and privilege level per session and alert on sudden increases in administrator-context queries.
Review MarkLogic App Server configuration periodically to confirm ODBC endpoints are only exposed where required.

How to Mitigate CVE-2026-9192

Immediate Actions Required

Upgrade Progress MarkLogic Server to version 11.3.6, 12.0.3, or later as documented in the vendor bulletin.
Restrict network access to the ODBC App Server so only authorized application hosts can reach the listener.
Rotate credentials for administrative and application accounts after patching to invalidate any sessions that may have been abused.
Review MarkLogic audit logs for signs of unauthorized administrative activity prior to the patch date.

Patch Information

Progress has released fixed versions 11.3.6 and 12.0.3 of MarkLogic Server. Full remediation details are provided in the Progress MarkLogic Critical Security Alert Bulletin – August 2026. Administrators should apply the appropriate fixed version for their deployment track without delay.

Workarounds

Disable the ODBC App Server on affected MarkLogic instances if it is not required for business operations.
Place the ODBC App Server behind a firewall or VPN and restrict inbound access to a minimal allowlist of client hosts.
Segment MarkLogic deployments into isolated network zones and block ODBC listener ports at perimeter and internal firewalls where possible.

bash

# Example: restrict inbound access to the MarkLogic ODBC App Server port using iptables
# Replace <ODBC_PORT> with the configured App Server port and <ALLOWED_CIDR> with the trusted client range
iptables -A INPUT -p tcp --dport <ODBC_PORT> -s <ALLOWED_CIDR> -j ACCEPT
iptables -A INPUT -p tcp --dport <ODBC_PORT> -j DROP