PT-2026-45073 · Apache · Apache Solr

Naveen Sunkavally · CVE-2026-44825 · Published 2026-05-29 · Updated 2026-07-09

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Solr versions 9.4.0 through 9.10.1 Apache Solr version 10.0.0

Description The Basic Authentication setup tool bin/solr auth enable contains hardcoded credentials. This allows a remote attacker to gain full administrative access to the cluster using publicly known default credentials that are installed silently alongside the user-specified account. Approximately 1,154 internet-exposed Solr Admin assets have been identified.

Recommendations For Apache Solr versions 9.4.0 through 9.10.1, upgrade to version 9.11.0. For Apache Solr version 10.0.0, upgrade to version 10.1.0. As a temporary workaround, delete the template users (superadmin, admin, search, index) from security.json or change their passwords.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-1188

CWE-798

Related Identifiers

BDU:2026-08899

BIT-SOLR-2026-44825

CVE-2026-44825

GHSA-QHR7-H655-PW6R

Affected Products

Apache Solr

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44825.json · Exploit
• https://osv.dev/vulnerability/GHSA-qhr7-h655-pw6r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44825 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-08899 · Security Note
• https://ubuntu.com/security/CVE-2026-44825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44825 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44825 · Vendor Advisory
• https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch · Vendor Advisory
• https://osv.dev/vulnerability/BIT-solr-2026-44825 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44825 · Security Note
• https://github.com/apache/lucene-solr · Note
• https://github.com/shinthink/solrradar · Note
• https://twitter.com/oss_security/status/2060508688603808200 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/29/6 · Note
• https://issues.apache.org/jira/browse/SOLR-18233 · Note