CVE-2026-44825: Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected: Clusters where bin/solr auth enable was not used to bootstrap BasicAuth Clusters where template users have been assigned strong passwords after bootstrap
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.11.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.1.0 - Operational
For clusters where `bin/solr auth enable` was used to bootstrap BasicAuth, remove the template users (superadmin, admin, search, index) from `security.json` as an immediate workaround.
- Operational
For clusters where `bin/solr auth enable` was used to bootstrap BasicAuth, if you do not delete the template users from `security.json`, change their passwords.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44825?
CVE-2026-44825 has a critical severity score of 9.8.
How do I fix CVE-2026-44825?
To fix CVE-2026-44825, upgrade to Apache Solr versions 9.10.2 or later, or 10.0.1 or later which address this vulnerability.
What are the risks associated with CVE-2026-44825?
CVE-2026-44825 allows a remote attacker to gain full administrative access to the Apache Solr cluster using hardcoded default credentials.
Which versions of Apache Solr are affected by CVE-2026-44825?
CVE-2026-44825 affects Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0.
What actions should be taken to mitigate CVE-2026-44825?
In addition to upgrading, it's recommended to review and implement proper security configurations to disable unnecessary users.