CVE-2026-22444: Apache Solr Core Creation Insufficient File Access Validation
Summary
CVE-2026-22444: Apache Solr: Insufficient file-access checking in standalone core-creation requests. Affects org.apache.solr:solr-core versions >= 8.6.0, < 9.10.1. Fixed in 9.10.1. How to fix ↓
Also tracked for
- solr · Bitnami
The same CVE-2026-22444 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It is designed for scalability and provides powerful full-text search capabilities. Solr is widely used for its advanced features such as faceted search, hit highlighting, and real-time indexing. However, certain versions of Solr, specifically from 8.6 to 9.10.0, have a vulnerability in the 'create core' API that can lead to unauthorized file access.
Vulnerability Detail
The vulnerability arises from insufficient input validation in the 'create core' API of Apache Solr versions 8.6 through 9.10.0. This flaw allows Solr to check for the existence of file-system paths that should be restricted by the 'allowPaths' security setting. As a result, untrusted users can create cores using unexpected configsets if they have access to certain filesystem paths. On Windows systems, this vulnerability can also lead to the disclosure of NTLM 'user' hashes, posing a significant security risk.
How To Fix
Latest published version: 10.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.10.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should enable Solr's RuleBasedAuthorizationPlugin if it is disabled. Additionally, configure a permission-list that restricts untrusted users from creating new Solr cores. This can be done by ensuring that the 'core-admin-edit' predefined permission is not granted to low-trust user roles.
Conclusion
In summary, the vulnerability identified as CVE-2026-22444 in Apache Solr poses significant risks due to insufficient file access validation in the 'create core' API. Users are strongly advised to upgrade to version 9.10.1 or greater and implement the suggested workarounds to mitigate potential security threats.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr versions 8.6 through 9.10.0 are affected by this vulnerability.
If left unaddressed, untrusted users may exploit this vulnerability to create cores with unauthorized configurations, potentially leading to data exposure and security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
If immediate upgrading is not possible, implement the recommended workarounds by enabling the RuleBasedAuthorizationPlugin and restricting permissions for untrusted users.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
