CLEANSTART-2026-FS36096: `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...
Published Nov 13, 2026
·Updated
Security vulnerability affects the solr package. The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent.
Affected Software
1 affected componentFixes available
cleanstart/solr<9.11.0-r2
9.11.0-r2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/solrto a version that resolves this vulnerability.Fixed in 9.11.0-r2
Event History
Nov 13, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What access and interaction are required to exploit this issue?
The CVSS vector indicates network access, low attack complexity, and no user interaction. The vulnerability description specifies that the attacker must be an authenticated client.
2
What is the stated security impact?
The issue is rated high severity with a CVSS score of 7.5. It has high integrity impact, with no stated confidentiality or availability impact.