Vulnerability · Published Jun 1, 2026 · Assigned by apache
CVE-2026-44825Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
High 8.1
In plain English
A high-severity hard-coded credentials in Apache Solr from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue. Not affected: * Clusters where bin/solr auth enable was not used to bootstrap BasicAuth * Clusters where template users have been assigned strong passwords after bootstrap
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.solr:solr-core | no fix listed | GHSA-qhr7-h655-pw6r |
| Maven | org.apache.solr:solr-core | no fix listed | GHSA-qhr7-h655-pw6r |
| Ubuntu:22.04:LTS | lucene-solr | no fix listed | UBUNTU-CVE-2026-44825 |
| Ubuntu:24.04:LTS | lucene-solr | no fix listed | UBUNTU-CVE-2026-44825 |
| Ubuntu:25.10 | lucene-solr | no fix listed | UBUNTU-CVE-2026-44825 |
| Ubuntu:26.04:LTS | lucene-solr | no fix listed | UBUNTU-CVE-2026-44825 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Solr | 9.4.0 – through 9.10.110.0.0 |
Weakness: CWE-798, CWE-1188 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H