PT-2026-3769 · Apache · Apache Solr

Damon Toey · Published 2026-01-21 · Updated 2026-04-02 · CVE-2026-22444

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Solr versions 8.6 through 9.10.0

Description The 'create core' API in Apache Solr does not properly validate input for certain API parameters. This can lead Solr to check for and attempt to read file system paths that should be restricted by the 'allowPaths' security setting. Successful exploitation could allow users to create cores using unexpected configsets if accessible via the file system. On Windows systems allowing UNC paths, this could also result in the disclosure of NTLM "user" hashes. The issue requires Solr to be running in standalone mode, utilizing the 'allowPath' setting for file access restriction, and having the 'create core' API exposed to untrusted users, potentially due to a disabled or misconfigured RuleBasedAuthorizationPlugin.

Recommendations Upgrade to Apache Solr version 9.10.1 or greater. Enable Solr’s RuleBasedAuthorizationPlugin if it is disabled. Configure a permission list that prevents untrusted users from creating new Solr cores.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-SOLR-2026-22444

CVE-2026-22444

GHSA-VC2W-4V3P-2MQW

Affected Products

Apache Solr

References · 16

• https://ubuntu.com/security/CVE-2026-22444 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22444 · Vendor Advisory
• https://lists.apache.org/thread/qkrb9dd4xrlqmmq73lrhkbfkttto2d1m · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22444 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22444 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vc2w-4v3p-2mqw · Vendor Advisory
• https://osv.dev/vulnerability/BIT-solr-2026-22444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22444 · Security Note
• https://github.com/apache/solr · Note
• https://twitter.com/oss_security/status/2014207773953712622 · Twitter Post
• https://issues.apache.org/jira/browse/SOLR-18058 · Note
• http://openwall.com/lists/oss-security/2026/01/20/5 · Note
• https://t.me/CVEtracker/42659 · Telegram Post
• https://twitter.com/CVEnew/status/2013976720764789015 · Twitter Post
• https://twitter.com/cracbot/status/2015741555395723485 · Twitter Post