CVE-2021-29262: Improper permission handling in Apache Solr
Summary
CVE-2021-29262: Improper permission handling in Apache Solr. Affects org.apache.solr:solr-core versions < 8.8.2. Fixed in 8.8.2. How to fix ↓
Also tracked for
- solr · Bitnami
The same CVE-2021-29262 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, faceted search, and distributed search capabilities. Solr is widely used in various applications to enable efficient and scalable search functionality. However, versions prior to 8.8.2 are vulnerable to an improper permission handling issue.
Vulnerability Detail
The vulnerability in Apache Solr arises when it is configured with certain ACL providers and no existing security.json znode. If the optional read-only user is configured, Solr does not treat the corresponding node as a sensitive path and allows it to be readable. Additionally, if the security.json is already present, Solr does not automatically update the ACLs. This vulnerability can potentially lead to unauthorized access to sensitive information.
How To Fix
Latest published version: 10.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.8.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is to manually update the ACLs for the sensitive paths in the security.json file. By ensuring that the appropriate permissions are set, the vulnerability can be mitigated. Here is an example of how to update the ACLs:
{
"authentication": {
"class": "solr.BasicAuthPlugin",
"credentials": {
"solr": "password"
}
},
"authorization": {
"class": "solr.RuleBasedAuthorizationPlugin",
"permissions": [
{
"name": "security-edit",
"role": "admin"
},
{
"name": "collection-admin-edit",
"role": "admin"
}
]
}
}
Conclusion
The vulnerability in Apache Solr (CVE-2021-29262) can be mitigated by upgrading to version 8.8.2 or later. Alternatively, manual ACL updates can be applied. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr is an open-source search platform built on Apache Lucene. It provides powerful search capabilities for various applications.
Versions of Apache Solr prior to 8.8.2 are affected by this vulnerability.
This vulnerability allows unauthorized users to read sensitive information if the optional read-only user is configured. It can lead to a breach of confidentiality.
To fix this vulnerability, upgrade to Apache Solr version 8.8.2 or later. Alternatively, manually update the ACLs in the security.json file.
Yes, a workaround is to manually update the ACLs in the security.json file. Refer to the provided example in the 'workaround' section.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
