RHLW-2026-edc9411f6043d0f2: Lightwell Security Advisory: solr-core 10.0.0.rhlw-00003

Q: Which deployments are exposed to this issue?

The issue concerns Apache Solr deployments where BasicAuth is enabled using the bin/solr CLI. The advisory identifies org.apache.solr:solr-core 10.0.0 as the upstream artifact addressed by the patched replacement.

Q: What should teams use to remediate the issue?

Use Red Hat Lightwell's org.apache.solr:solr-core 10.0.0.rhlw-00003 artifact. It is described as a drop-in replacement for org.apache.solr:solr-core 10.0.0 from Maven Central.

Published Nov 6, 2026

Updated

Red Hat Lightwell has released org.apache.solr:solr-core 10.0.0.rhlw-00003 with a backported security fix.

CVE-2026-44825: Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users

This patched artifact is a drop-in replacement for org.apache.solr:solr-core 10.0.0 from Maven Central.

Affected Software

1 affected componentFixes available

red-hat-lightwell/org.apache.solr:solr-core<10.0.0.rhlw-00003

10.0.0.rhlw-00003

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade red-hat-lightwell/org.apache.solr:solr-core to a version that resolves this vulnerability.
Fixed in 10.0.0.rhlw-00003
Upgrade
Upgrade org.apache.solr:solr-core to a version that resolves this vulnerability.
Fixed in 10.0.0.rhlw-00003

Event History

Nov 6, 2026

Advisory Published

via OSV·09:43 AM

Data Sourced

via OSV·09:43 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are exposed to this issue?