CVE-2026-44825
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
- Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
- Clusters where template users have been assigned strong passwords after bootstrap
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
- Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
- Clusters where template users have been assigned strong passwords after bootstrap
- Record
CVE-2026-44825- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-798, CWE-1188
- Updated
- 2026-11-02
EUVDEUVD-2026-33602
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
- Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
- Clusters where template users have been assigned strong passwords after bootstrap
- Record
EUVD-2026-33602- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qhr7-h655-pw6r
Apache Solr has hardcoded credentials in the Basic Authentication setup tool
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
- Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
- Clusters where template users have been assigned strong passwords after bootstrap
- Record
GHSA-qhr7-h655-pw6r- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-798
- Updated
- 2026-11-02
NVD
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
- Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
- Clusters where template users have been assigned strong passwords after bootstrap
- Record
CVE-2026-44825- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-798, CWE-1188
- Updated
- 2026-11-02
OSV
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
- Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
- Clusters where template users have been assigned strong passwords after bootstrap
- Record
CVE-2026-44825- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1188, CWE-798
- Updated
- 2026-11-02
OSVGHSA-qhr7-h655-pw6r
Apache Solr has hardcoded credentials in the Basic Authentication setup tool
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
- Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
- Clusters where template users have been assigned strong passwords after bootstrap
- Record
GHSA-qhr7-h655-pw6r- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-798
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-44825
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue. Not affected: * Clusters where bin/solr auth enable was not used to bootstrap BasicAuth * Clusters where template users have been assigned strong passwords after bootstrap
- Record
UBUNTU-CVE-2026-44825- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-solr-2026-44825 No score
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
- Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
- Clusters where template users have been assigned strong passwords after bootstrap
- Record
BIT-solr-2026-44825- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.solr:solr-coreMaven |
9.4.0 to 9.10.1 | None known |
org.apache.solr:solr-coreMaven |
10.0.0 to 10.0.0 | None known |
solrBitnami |
9.4.0 up to 10.1.0 | 10.1.0 |
org.apache.solr:solr-coreMaven |
9.4.0 to 9.10.1, plus listed versions 9.10.09.4.19.5.09.6.09.6.1 Show 4 moreShow less9.7.09.8.09.8.19.9.0 |
None known |
org.apache.solr:solr-coreMaven |
Listed versions 10.0.0 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | gagaltotal/CVE-2026-44825-Apache-Solr-Scanner | 2026-07-08 |
| PoC in GitHub | q0524/CVE-2026-44825_CTF | 2026-10-15 |
| PoC in GitHub | shinthink/solrradar | 2026-07-03 |
| Nuclei | Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44825 is a high vulnerability (CVSS 8.1) in Apache Solr, published June 1, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.92%, the 90th percentile. Fixed in solr 10.1.0.