CVE-2026-44825 Details
Description
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue. Not affected: * Clusters where bin/solr auth enable was not used to bootstrap BasicAuth * Clusters where template users have been assigned strong passwords after bootstrap
A vulnerability exists in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0, where hardcoded credentials in the Basic Authentication setup tool enable remote attackers to gain full administrative access to the cluster. This is achieved through publicly known default credentials that are silently installed alongside the user-specified account. The vulnerability arises when the 'bin/solr auth enable' command is used to bootstrap Basic Authentication, creating template users with default passwords that can be exploited. Clusters that have not used this command or have assigned strong passwords to the template users after bootstrapping are not affected.
As an immediate workaround, delete the template users (superadmin, admin, search, index) from the security.json file or change their passwords. Upgrade to Apache Solr versions 9.11.0 or 10.1.0, which will not be vulnerable.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/29/6 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache solr | >= 9.4.0, <= 9.10.1 10.0.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| Jun 1, 2026 | CVE Modified | CVE |
| Jun 1, 2026 | New CVE Received | [email protected] |