PT-2026-45073 · Apache · Apache Solr

Naveen Sunkavally · Published 2026-05-29 · Updated 2026-06-12 · CVE-2026-44825

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Solr versions 9.4.0 through 9.10.1 Apache Solr version 10.0.0

Description The Basic Authentication setup tool bin/solr auth enable contains hardcoded credentials. This allows a remote attacker to gain full administrative access to the cluster using publicly known default credentials that are installed silently alongside the account specified by the user.

Recommendations For versions 9.4.0 through 9.10.1, upgrade to version 9.11.0. For version 10.0.0, upgrade to version 10.1.0. As a temporary workaround, delete the template users (superadmin, admin, search, index) from security.json or change their passwords.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-1188

Related Identifiers

BIT-SOLR-2026-44825

CVE-2026-44825

Affected Products

Apache Solr

References · 15

• https://ubuntu.com/security/CVE-2026-44825 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44825 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44825 · Vendor Advisory
• https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch · Vendor Advisory
• https://osv.dev/vulnerability/BIT-solr-2026-44825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44825 · Security Note
• https://issues.apache.org/jira/browse/SOLR-18233 · Note
• https://twitter.com/CriminalIP_US/status/2065418855191654615 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2062006860312440911 · Twitter Post
• https://twitter.com/Horizon3ai/status/2061908020435538309 · Twitter Post
• https://t.me/CVEtracker/55455 · Telegram Post
• https://twitter.com/vuldb/status/2061381640098849094 · Twitter Post
• https://twitter.com/oss_security/status/2060508688603808200 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/29/6 · Note
• https://i.redd.it/g6nse8t5ix4h1.png · Reddit Post