CVE-2026-9193: MarkLogic Server Privilege Escalation Flaw

CVE-2026-9193 Overview

CVE-2026-9193 is an improper privilege management vulnerability [CWE-269] in the Hadoop integration of Progress MarkLogic Server. The flaw affects MarkLogic Server versions before 11.3.6 and 12.0.3. An authenticated user holding a low-privileged Hadoop role can escalate privileges and execute privileged operations against the Security database. Progress disclosed the issue in its August 2026 Security Alert Bulletin. Successful exploitation gives attackers control over authentication, authorization, and role assignments within the database platform.

Critical Impact
A low-privileged Hadoop role can escalate to full control of the MarkLogic Security database, compromising authentication and authorization across the deployment.

Affected Products

Progress MarkLogic Server versions before 11.3.6
Progress MarkLogic Server 12.x versions before 12.0.3
MarkLogic deployments using the Hadoop integration (MarkLogic Connector for Hadoop)

Discovery Timeline

2026-08-05 - CVE-2026-9193 published to NVD
2026-08-05 - Progress publishes MarkLogic Critical Security Alert Bulletin (August 2026)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-9193

Vulnerability Analysis

The vulnerability resides in how the MarkLogic Hadoop integration handles privilege checks when brokered operations reach the Security database. The Hadoop connector enables MapReduce jobs and distributed workloads to read from and write to MarkLogic. In vulnerable versions, requests originating from Hadoop role holders are not properly restricted before reaching sensitive database operations. An attacker who authenticates with any low-privileged Hadoop role can invoke operations that should require administrative or security-admin roles. Impacted operations target the Security database, which stores users, roles, privileges, and amps. Compromise of that database undermines the entire authorization model of the MarkLogic cluster.

Root Cause

The root cause is improper privilege management [CWE-269] in the Hadoop integration code path. The integration relies on caller-supplied role context without re-validating whether the caller is authorized to perform privileged Security database actions. Progress addresses the flaw in MarkLogic Server 11.3.6 and 12.0.3 by tightening privilege enforcement in the Hadoop integration.

Attack Vector

The attack requires network access to MarkLogic and valid credentials for any account with a Hadoop role. The attacker submits crafted operations through the Hadoop integration interface that target Security database functions. Because the scope changes during exploitation, actions executed against the Security database affect resources beyond the attacker's assigned role. Consult the Progress MarkLogic Critical Security Alert Bulletin - August 2026 for vendor-supplied technical details.

No verified proof-of-concept code is publicly available for CVE-2026-9193.
Refer to the Progress Security Alert Bulletin (August 2026) for vendor
technical details on the vulnerable code path in the Hadoop integration.

Detection Methods for CVE-2026-9193

Indicators of Compromise

Unexpected modifications to users, roles, or privileges in the MarkLogic Security database originating from accounts with only Hadoop-related roles.
Hadoop connector sessions issuing operations that target security.xqy or privileged Security database endpoints outside normal MapReduce workflows.
New administrative or security-admin role grants that cannot be tied to a change-management ticket.

Detection Strategies

Audit MarkLogic access logs and Security database audit events for privileged operations invoked through Hadoop connector sessions.
Correlate Hadoop job submissions with subsequent role or privilege changes in the same session or short time window.
Enable and review MarkLogic audit events for create-user, create-role, grant-role, and amp modifications.

Monitoring Recommendations

Forward MarkLogic audit logs, access logs, and error logs to a centralized analytics platform for query and alerting.
Alert on any Security database write from a principal whose base role set does not include security or admin.
Track version strings reported by MarkLogic nodes to confirm patched builds are in production.

How to Mitigate CVE-2026-9193

Immediate Actions Required

Upgrade MarkLogic Server to 11.3.6, 12.0.3, or later on all cluster nodes.
Inventory all accounts holding Hadoop roles and remove roles from accounts that no longer require Hadoop connectivity.
Rotate credentials for any account with a Hadoop role if suspicious Security database activity is present in logs.
Review the Security database for unauthorized users, roles, or privilege grants created after the vulnerable versions were deployed.

Patch Information

Progress released fixed versions MarkLogic Server 11.3.6 and 12.0.3. Details are published in the Progress MarkLogic Critical Security Alert Bulletin - August 2026. Apply the upgrade to every node in the cluster and validate replication and application connectivity after patching.

Workarounds

If immediate patching is not possible, disable the Hadoop integration by removing the MarkLogic Connector for Hadoop from application servers.
Restrict network access to MarkLogic App Servers so that only trusted Hadoop clients can reach the connector endpoints.
Limit assignment of Hadoop roles to service accounts under strict change control until the upgrade is completed.

bash

# Verify MarkLogic Server version on each host after patching
curl -sk --anyauth --user admin:PASSWORD \
  https://marklogic-host:8002/manage/v2/hosts?format=json \
  | jq '.["host-default-list"]["list-items"]["list-item"][].nameref'

# Query cluster version through XQuery eval
curl -sk --anyauth --user admin:PASSWORD \
  -X POST https://marklogic-host:8000/v1/eval \
  --data-urlencode 'xquery=xdmp:version()'