← Back

CVE-2026-9203

nvd nist
Published: Aug 5, 2026Modified: Sep 3, 2026

JSON object

Loading...
8.5
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 6.0
Source: security@progress.com (Secondary)

Description

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.

Affected (2)

Progress
1 product
Marklogic Server
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Progress
Marklogic Server
Before 11.3.6
Marklogic Server
From 12.0.0 to 12.0.3

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

Source: security@progress.com
Vendor Advisory

Timeline

No history available yet.