Progress MarkLogic Server versions prior to 12.1.0 (12.x) and prior to 11.3.7 (11.x) can record security‑sensitive information such as credentials or tokens in trace and diagnostic logs when certain tracing configurations are enabled. An adversary who gains access to these logs could consume that data, potentially forging credentials or accessing protected resources without authorization. The flaw is identified as a log injection weakness with CWE‑532 describing the uncontrolled storage of sensitive information.

The vulnerability affects Progress Software Corporation's MarkLogic Server. Versions 12.x that precede 12.1.0 and 11.x that precede 11.3.7 are impacted. Users of older or unpatched releases should ascertain the exact build and consult the vendor advisory for the appropriate update path.

A CVSS score of 8.1 indicates significant severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local or delegated access to the system’s diagnostic log files, so the threat is most acute in environments where log files are not properly protected. If an attacker can read logs, the sensitivity of the exposed data could allow further unauthorized activity.