Sign in
Deutsch English Español Polski
High

Apache Solr has hardcoded credentials in the Basic Authentication setup tool

  • Disclosed: 01.06.2026
  • Updated: 11.10.2026 12:22

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.

As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.

Not affected:

  • Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
  • Clusters where template users have been assigned strong passwords after bootstrap

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.apache.solr:solr-core >= 9.4.0, <= 9.10.1, = 10.0.0 no fix

References

CVSS score 8.1/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-798
Platform
Java / Kotlin (Maven)
Package
org.apache.solr:solr-core
Disclosed
01.06.2026
Updated
11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-qhr7-h655-pw6r - CC BY 4.0

Vulnerability history: org.apache.solr:solr-core

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (31) in the archive
Total entries
31
First → latest
10.2018 06.2026
Without a fix
1
Exploited in attacks
2

Severity breakdown

  • Critical 4
  • High 16
  • Medium 10
  • Low 1

Disclosures per year

Severity:
  1. Apache Solr has hardcoded credentials in the Basic Authentication setup tool this entry
    High · 8.1 CVE-2026-44825 >= 9.4.0, <= 9.10.1, = 10.0.0 no fix
  2. Apache Solr: Insufficient file-access checking in standalone core-creation requests
    High · 7.1 CVE-2026-22444 >= 8.6.0, < 9.10.1 9.10.1
  3. Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
    High · 8.2 CVE-2026-22022 >= 5.3.0, < 9.10.1 9.10.1
  4. Apache Solr vulnerable to Execution with Unnecessary Privileges
    High CVE-2025-24814 < 9.8.0 9.8.0
  5. Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
    High · 8.8 CVE-2023-50386 >= 6.0.0, < 8.11.3, >= 9.0.0, < 9.4.1 8.11.3, 9.4.1
  6. Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies
    High · 7.5 CVE-2023-50291 >= 6.0.0, < 8.11.3, >= 9.0.0, < 9.3.0 8.11.3, 9.3.0
  7. Apache Solr vulnerable to XML Bomb
    High · 7.5 CVE-2019-12401 < 5.0.0 5.0.0
  8. Improper Restriction of XML External Entity Reference in Apache Solr
    High CVE-2012-6612 < 4.1.0 4.1.0
  9. Apache Solr insecure inter-node communication
    High · 7.5 CVE-2017-7660 >= 5.3.0, < 5.5.5, >= 6.0.0, < 6.6.0 5.5.5, 6.6.0
  10. Apache Solr Kerberos delegation token functionality flaws
    High · 7.5 CVE-2017-9803 >= 6.2.0, < 6.6.1 6.6.1
  11. Incorrect Authorization in Apache Solr
    Critical · 9.8 CVE-2020-13957 >= 6.6.0, < 8.6.3 8.6.3
  12. Improper permission handling in Apache Solr
    High · 7.5 CVE-2021-29262 < 8.8.2 8.8.2
  13. Improper Input Validation in Apache Solr
    High · 7.5 Exploited in attacks CVE-2019-17558 >= 5.0.0, < 8.4.0, >= 6.0.0, < 8.4.0, >= 7.0.0, < 8.4.0, >= 8.0.0, < 8.4.0 8.4.0
  14. Unrestricted upload of file with dangerous type in Apache Solr
    Critical · 9.8 CVE-2019-12409 >= 8.1.1, < 8.3.0 8.3.0
  15. XML External Entity (XXE) Injection in Apache Solr
    High · 7.2 Exploited in attacks CVE-2019-0193 < 8.2.0 8.2.0
  16. Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core
    High · 7.5 CVE-2017-3164 >= 1.3.0, < 7.7.0 7.7.0
  17. Critical severity vulnerability that affects org.apache.solr:solr-core
    Critical · 9.8 CVE-2019-0192 >= 5.0.0, < 7.0.0, >= 6.0.0, < 7.0.0 7.0.0
  18. Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core
    High · 7.5 CVE-2017-3163 < 5.5.4, >= 6.0.0, < 6.4.1 5.5.4, 6.4.1
  19. Remote code execution occurs in Apache Solr
    Critical · 9.8 CVE-2017-12629 >= 7.0.0, < 7.1.0, >= 6.0.0, < 6.6.2, >= 5.5.0, < 5.5.5 7.1.0, 6.6.2, 5.5.5
  20. There is a XML external entity expansion (XXE) vulnerability in Apache Solr
    High · 7.5 CVE-2018-1308 >= 1.2, < 6.6.3, >= 7.0.0, < 7.3.0 6.6.3, 7.3.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.