Description
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords.
The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
* Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
* Clusters where template users have been assigned strong passwords after bootstrap
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Solr | 9.4.0 – ≤ 9.10.1, 10.0.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
gagaltotal/CVE-2026-44825-Apache-Solr-Scanner ★ 12 · Jul 8, 2026
Apache Solr instances that may be affected by CVE-2026-44825, related to Velocity Template Remote Code Execution (RCE) conditions.
-
shinthink/solrradar ★ 5 · Jul 3, 2026
☄️ Mass reconnaissance & exploitation framework for Apache Solr CVE-2026-44825 — Velocity template injection to RCE
-
q0524/CVE-2026-44825_CTF ★ 0 · Oct 15, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials http/cves/2026/CVE-2026-44825.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.solr:solr-core | >= 9.4.0, <= 9.10.1 | — | GHSA-qhr7-h655-pw6r |
| Maven | org.apache.solr:solr-core | 10.0.0 | — | GHSA-qhr7-h655-pw6r |
Advisories 1
- WID-SEC-2026-1740 Apache Solr: Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · May 31, 2026
References
- https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch vendor-advisory