CVE-2026-44825: Apache Solr Hardcoded Credentials in Basic Authentication Setup Tool
Summary
CVE-2026-44825: Apache Solr has hardcoded credentials in the Basic Authentication setup tool. Affects org.apache.solr:solr-core versions >= 9.4.0, <= 9.10.1. No fix is published. How to fix ↓
Also tracked for
- solr · Bitnami
The same CVE-2026-44825 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It is designed for scalability and is widely used for enterprise search applications. Solr provides features such as full-text search, faceted search, and real-time indexing. However, certain versions of Solr have been found to contain hardcoded credentials in the Basic Authentication setup tool, which poses a significant security risk.
Vulnerability Detail
The vulnerability arises from hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0. This flaw allows remote attackers to gain full administrative access to the Solr cluster using default credentials that are publicly known. The presence of these credentials, installed silently alongside user-specified accounts, can lead to unauthorized access and potential data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from the security.json file or change their passwords. This can be done by editing the security.json file located in the Solr configuration directory and removing or modifying the relevant entries.
Conclusion
The hardcoded credentials in Apache Solr's Basic Authentication setup tool present a significant security risk. Users are strongly advised to upgrade to the latest versions or implement the recommended workarounds to secure their Solr instances.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 are affected by this vulnerability.
The potential risks include unauthorized administrative access to the Solr cluster, which can lead to data breaches and manipulation of search functionalities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot upgrade immediately, you should delete the template users from security.json or change their passwords to mitigate the risk.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
