CVE-2024-45216
Apache Solr: Authentication bypass possible using a fake URL Path ending
Improper Authentication vulnerability in Apache Solr.
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.
This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Solr: Authentication bypass possible using a fake URL Path ending
Improper Authentication vulnerability in Apache Solr.
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.
This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
- Record
CVE-2024-45216- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287, CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2024-3084
Improper Authentication vulnerability in Apache Solr.
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.
This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
- Record
EUVD-2024-3084- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mjvf-4h88-6xm3
Improper Authentication vulnerability in Apache Solr
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.
This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
- Record
GHSA-mjvf-4h88-6xm3- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287, CWE-863
- Updated
- 2026-11-02
NVD
Improper Authentication vulnerability in Apache Solr.
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.
This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
- Record
CVE-2024-45216- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287, CWE-863
- Updated
- 2026-11-02
OSV
Apache Solr: Authentication bypass possible using a fake URL Path ending
Improper Authentication vulnerability in Apache Solr.
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.
This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
- Record
CVE-2024-45216- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-mjvf-4h88-6xm3
Improper Authentication vulnerability in Apache Solr
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.
This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
- Record
GHSA-mjvf-4h88-6xm3- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287, CWE-863
- Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2024-45216
Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
- Record
UBUNTU-CVE-2024-45216- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-solr-2024-45216No score
Apache Solr: Authentication bypass possible using a fake URL Path ending
Improper Authentication vulnerability in Apache Solr.
Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.
This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.
Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
- Record
BIT-solr-2024-45216- Updated
- 2026-11-02
OSVCLSA-2026-1794326730No score
TuxCare security update for org.apache.solr:solr-solrj (1 CVE)
TuxCare rebuilt org.apache.solr:solr-solrj to address 1 CVE. Fixed in 8.5.2-tuxcare.8.
- Record
CLSA-2026-1794326730- Updated
- 2026-11-10
OSVCLSA-2026-1794398089No score
TuxCare security update for org.apache.solr (2 CVEs)
TuxCare rebuilt 16 org.apache.solr packages to address 2 CVEs. Fixed in 5.5.5-tuxcare.6.
- Record
CLSA-2026-1794398089- Updated
- 2026-11-11
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.solr:solrMaven | 5.3.0 up to 8.11.4 | 8.11.4 |
org.apache.solr:solrMaven | 9.0.0 up to 9.7.0 | 9.7.0 |
solrBitnami | 5.3.0 up to 8.11.4, 9.0.0 up to 9.7.0 | 8.11.49.7.0 |
org.apache.solr:solr-solrjTuxCare:Maven | 8.5.2 up to 8.5.2-tuxcare.8, plus listed versions 8.5.2-tuxcare.18.5.2-tuxcare.28.5.2-tuxcare.38.5.2-tuxcare.48.5.2-tuxcare.58.5.2-tuxcare.68.5.2-tuxcare.7 | 8.5.2-tuxcare.8 |
org.apache.solr:solr-analysis-extrasTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-analyticsTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-cellTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-clusteringTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-coreTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-dataimporthandlerTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.solr:solr-dataimporthandler-extrasTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-langidTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-map-reduceTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-morphlines-cellTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-morphlines-coreTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-parentTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-solrjTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-test-frameworkTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-uimaTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
org.apache.solr:solr-velocityTuxCare:Maven From an advisory covering 2 CVEs | 5.5.5 up to 5.5.5-tuxcare.6, plus listed versions 5.5.5-tuxcare.15.5.5-tuxcare.25.5.5-tuxcare.35.5.5-tuxcare.45.5.5-tuxcare.5 | 5.5.5-tuxcare.6 |
lucene-solrUbuntu:Pro:14.04:LTS | All versions, plus listed versions 3.6.2+dfsg-13.6.2+dfsg-23.6.2+dfsg-2ubuntu0.1~esm13.6.2+dfsg-2ubuntu0.1~esm23.6.2+dfsg-2ubuntu0.1~esm4 | None known |
lucene-solrUbuntu:Pro:16.04:LTS | All versions, plus listed versions 3.6.2+dfsg-73.6.2+dfsg-83.6.2+dfsg-8ubuntu0.13.6.2+dfsg-8ubuntu0.1+esm1 | None known |
lucene-solrUbuntu:Pro:18.04:LTS | All versions, plus listed versions 3.6.2+dfsg-103.6.2+dfsg-113.6.2+dfsg-18~18.043.6.2+dfsg-18~18.04.1~esm2 | None known |
lucene-solrUbuntu:20.04:LTS | All versions, plus listed versions 3.6.2+dfsg-203.6.2+dfsg-22 | None known |
lucene-solrUbuntu:22.04:LTS | All versions, plus listed versions 3.6.2+dfsg-24 | None known |
lucene-solrUbuntu:24.04:LTS | All versions, plus listed versions 3.6.2+dfsg-26 | None known |
lucene-solrUbuntu:25.10 | All versions, plus listed versions 3.6.2+dfsg-26 | None known |
lucene-solrUbuntu:26.10 | All versions, plus listed versions 3.6.2+dfsg-27 | None known |
lucene-solrUbuntu:26.04:LTS | All versions, plus listed versions 3.6.2+dfsg-263.6.2+dfsg-27 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | congdong007/CVE-2024-45216-Poc | 2024-12-02 |
| Nuclei | Apache Solr - Authentication Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases, exploits, facts | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45216 is a critical vulnerability (CVSS 9.8) in Apache Solr, published October 16, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 92.7%, the 99th percentile. Fixed in org.apache.solr:solr 8.11.4.
References
solr.apache.org/security.html
openwall.com/lists/oss-security/2024/10/15/8
nvd.nist.gov/vuln/detail/CVE-2024-45216
issues.apache.org/jira/browse/SOLR-17417
github.com/advisories/GHSA-mjvf-4h88-6xm3
svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/webapp
ubuntu.com/security/CVE-2024-45216
cve.org/CVERecord?id=CVE-2024-45216