CLEANSTART-2026-ON66992: unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path

Q: Which deployments are exposed?

Deployments of the solr package that use EthereumAuthenticator are affected when protected-resource request paths contain the configured login path. The available data does not identify affected versions or whether EthereumAuthenticator is enabled by default.

Q: What must an attacker do to exploit this issue?

An attacker must be unauthenticated and send a request for certain protected resources using a path that contains the configured login path. No additional prerequisites are provided.

Q: How can I determine whether my deployment may be affected?

Review whether your solr deployment uses EthereumAuthenticator and identify its configured login path. Then check whether paths to protected resources can contain that login-path value.

Published Nov 8, 2026

Updated

Security vulnerability affects the solr package. An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.

Affected Software

1 affected componentFixes available

cleanstart/solr<10.1.0-r0

10.1.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 10.1.0-r0

Event History

Nov 8, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-19863

Frequently Asked Questions

Which deployments are exposed?

Deployments of the solr package that use EthereumAuthenticator are affected when protected-resource request paths contain the configured login path. The available data does not identify affected versions or whether EthereumAuthenticator is enabled by default.

What must an attacker do to exploit this issue?

An attacker must be unauthenticated and send a request for certain protected resources using a path that contains the configured login path. No additional prerequisites are provided.

How can I determine whether my deployment may be affected?

Review whether your solr deployment uses EthereumAuthenticator and identify its configured login path. Then check whether paths to protected resources can contain that login-path value.

CLEANSTART-2026-ON66992: unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed?

What must an attacker do to exploit this issue?

How can I determine whether my deployment may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker do to exploit this issue?

How can I determine whether my deployment may be affected?