Two MarkLogic Flaws That Could Hand Over Admin Keys

Michael Miller · 2026-10-13

Imagine giving someone limited access to your database—just enough to manage a few things—and then watching them quietly take full control. That's exactly what two newly discovered flaws in Progress Software's MarkLogic Server could allow. The company disclosed 31 vulnerabilities on October 12, and five of them are rated critical. Among those, two are particularly nasty: they let an account with only some management privileges escalate to full administrator. In other words, a delegated manager could become a permanent admin, and you might not even notice. ### What Exactly Happened? Progress published all 31 flaws on October 12. Five were scored critical, meaning they pose a serious risk if left unpatched. The two that stand out involve privilege escalation. An attacker—or even a careless insider—with limited management rights could exploit these to gain persistent admin control over the entire MarkLogic Server. That's like giving someone a key to the supply closet and finding out they can now open every door in the building. ### Why This Matters for Your Security If you're running MarkLogic, you need to know: fixes have been available since September 10. They're included in MarkLogic 11.3.7 and MarkLogic 12.1.0. So if you haven't updated yet, you're leaving the back door unlocked. The affected versions are any release prior to those two. That means if you're on an older version, you're at risk. > "The longer you wait, the more time an attacker has to exploit these flaws. Patching isn't just a good practice—it's your first line of defense." ### What Should You Do Right Now? - **Check your version.** If you're running anything older than 11.3.7 or 12.1.0, you're vulnerable. - **Apply the patch immediately.** Don't wait for a maintenance window. These are critical flaws. - **Review user permissions.** Even after patching, audit who has management privileges. Least privilege is your friend. - **Monitor for unusual activity.** Look for unexpected admin actions or new accounts with elevated rights. ### The Bigger Picture This isn't just about MarkLogic. It's a reminder that privilege escalation flaws are among the most dangerous because they turn a small foothold into total control. Whether you're managing a database, a website, or a fleet of antidetect browsers, the principle is the same: limit access, patch quickly, and never assume you're safe. If you're using antidetect browsers to manage multiple accounts, the same logic applies. A compromised browser profile could lead to broader access if permissions aren't locked down. So while you're patching MarkLogic, take a moment to review your browser security too. ### Final Thought Two flaws. One patch. A world of difference. Don't let a delegated manager become your worst nightmare. Update to MarkLogic 11.3.7 or 12.1.0 today, and sleep a little easier tonight.