Advisoriesby IbisApache SolrGHSA-qhr7-h655-pw6r
Apache Solr has hardcoded credentials in the Basic Authentication setup tool
No fix yet
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords.
The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
- Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
- Clusters where template users have been assigned strong passwords after bootstrap
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.solr:solr-core Maven | >= 9.4.0, <= 9.10.1 | No fix yet |
| <= 10.0.0 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-798
- Also known as
- BIT-solr-2026-44825, CVE-2026-44825
More Apache Solr advisories
All Apache Solr
Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPluginCVE-2026-22022fixed in 9.10.1Apache Solr: Insufficient file-access checking in standalone core-creation requestsCVE-2026-22444fixed in 9.10.1Apache Solr Relative Path Traversal vulnerabilityCVE-2024-52012fixed in 9.8.0Apache Solr vulnerable to Execution with Unnecessary PrivilegesCVE-2025-24814fixed in 9.8.0Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsCVE-2023-50386fixed in 8.11.3 +1Apache Solr can leak certain passwords due to System Property redaction logic inconsistenciesCVE-2023-50291fixed in 8.11.3 +1