CVE-2026-22022: Apache Solr Unauthorized Access via RuleBasedAuthorizationPlugin
Summary
CVE-2026-22022: Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input validation in... Affects org.apache.solr:solr-core versions >= 5.3.0, < 9.10.1. Fixed in 9.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It is designed for scalability and provides powerful full-text search capabilities, faceted search, and real-time indexing. The RuleBasedAuthorizationPlugin is a component that allows administrators to define access control rules for various Solr APIs. However, certain configurations can lead to unauthorized access, making it critical to understand and address these vulnerabilities.
Vulnerability Detail
The vulnerability arises from insufficient input validation in the RuleBasedAuthorizationPlugin, which can allow unauthorized access to specific Solr APIs. This issue affects deployments of Apache Solr versions 5.3.0 through 9.10.0 that utilize the RuleBasedAuthorizationPlugin with certain configurations. If the configuration specifies multiple roles and predefined permission rules without including the 'all' permission, it can lead to unauthorized access, especially in setups where network requests are unfiltered. The ramifications include potential exposure of sensitive data and unauthorized manipulation of Solr configurations.
How To Fix
Latest published version: 10.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.10.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can modify their RuleBasedAuthorizationPlugin configuration to include the 'all' predefined permission and associate it with an 'admin' or other privileged role. This adjustment can help mitigate unauthorized access until an upgrade is performed.
Conclusion
In summary, CVE-2026-22022 is a significant vulnerability in Apache Solr that can lead to unauthorized access if specific configurations are used. It is crucial for users to upgrade to the patched version or implement the recommended workaround to secure their deployments.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr versions 5.3.0 through 9.10.0 are affected by this vulnerability.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The main cause of this vulnerability is insufficiently strict input validation in the RuleBasedAuthorizationPlugin.
If immediate upgrading is not possible, implement the workaround by adjusting your RuleBasedAuthorizationPlugin configuration to include the 'all' permission.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
