Apache Software Foundation Solr vulnerabilities

• apache solr Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users CVE-2026-44825 Public exploitFix available 8.1 HighJune 1, 2026
• apache solr Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin CVE-2026-22022 Fix available 8.2 HighJanuary 21, 2026
• apache solr Apache Solr: Insufficient file-access checking in standalone core-creation requests CVE-2026-22444 Public exploitFix available 7.1 HighJanuary 21, 2026
• apache solr Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files CVE-2025-24814 Fix available 5.5 MediumJanuary 27, 2025
• apache solr Apache Solr: Configset upload on Windows allows arbitrary path write-access CVE-2024-52012 Fix available EPSS 47.1% 5.4 MediumJanuary 27, 2025
• apache solr Apache Solr: ConfigSets created during a backup restore command are trusted implicitly CVE-2024-45217 Fix available 8.1 HighOctober 16, 2024
• apache solr Apache Solr: Authentication bypass possible using a fake URL Path ending CVE-2024-45216 Public exploitFix available EPSS 92.7% 9.8 CriticalOctober 16, 2024
• apache solr operator Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentials CVE-2024-31391 Fix available 6.5 MediumApril 12, 2024
• apache solr Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords CVE-2023-50291 Fix available 7.5 HighFebruary 9, 2024
• apache solr Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users CVE-2023-50292 Fix available 7.5 HighFebruary 9, 2024
• apache solr Apache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions CVE-2023-50298 Fix available 7.5 HighFebruary 9, 2024
• apache solr Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets CVE-2023-50386 Public exploitFix available EPSS 83.7% 8.8 HighFebruary 9, 2024
• apache solr Apache Solr: Host environment variables are published via the Metrics API CVE-2023-50290 Public exploitFix available EPSS 68.4% 6.5 MediumJanuary 15, 2024
• apache solr Apache Solr information disclosure vulnerability through DataImportHandler CVE-2021-44548 Fix available 9.8 CriticalDecember 23, 2021
• apache solr Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections CVE-2021-29943 Fix available 9.1 CriticalApril 13, 2021
• apache solr Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings CVE-2021-29262 Fix available 7.5 HighApril 13, 2021
• apache solr SSRF vulnerability with the Replication handler CVE-2021-27905 Public exploitFix available EPSS 93.1% 9.8 CriticalApril 13, 2021
• apache solr Incorrect Authorization in Apache Solr CVE-2020-13957 Public exploitFix available EPSS 79.3% 9.8 CriticalOctober 13, 2020
• apache solr Improper Input Validation in Apache Solr CVE-2020-13941 Public exploitFix available 8.8 HighAugust 17, 2020
• apache solr Incorrect Authorization in Apache Solr CVE-2018-11802 Fix available 4.3 MediumApril 1, 2020
• apache solr, oracle primavera unifier +1 more Improper Input Validation in Apache Solr CVE-2019-17558 In KEVPublic exploitFix available EPSS 98.6% 7.5 HighDecember 30, 2019
• apache solr, debian linux +1 more XML External Entity (XXE) Injection in Apache Solr CVE-2019-0193 In KEVPublic exploitFix available EPSS 83.5% 7.2 HighAugust 1, 2019
• apache solr Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core CVE-2017-3164 Public exploitFix available EPSS 19.4% 7.5 HighMarch 8, 2019
• apache solr, netapp storage automation store +1 more Critical severity vulnerability that affects org.apache.solr:solr-core CVE-2019-0192 Public exploitFix available EPSS 78.2% 9.8 CriticalMarch 7, 2019
• apache solr, netapp snapcenter, storage automation store +2 more XML external entity expansion in org.apache.solr:solr-core CVE-2018-8026 Fix available 5.5 MediumJuly 5, 2018
• apache solr There is a XML external entity expansion (XXE) vulnerability in Apache Solr config files CVE-2018-8010 Fix available 5.5 MediumMay 21, 2018
• apache solr, debian linux +1 more There is a XML external entity expansion (XXE) vulnerability in Apache Solr CVE-2018-1308 Fix available EPSS 20.8% 7.5 HighApril 9, 2018
• apache solr Apache Solr Kerberos delegation token functionality flaws CVE-2017-9803 Fix available 7.5 HighSeptember 18, 2017
• apache solr Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core CVE-2017-3163 Fix available 7.5 HighJuly 30, 2017
• apache solr Apache Solr insecure inter-node communication CVE-2017-7660 Fix available 7.5 HighJuly 7, 2017