Aller au contenu
en Se connecter
8.1 Élevée

CVE-2026-44825 Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0…

Description

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue. Not affected: * Clusters where bin/solr auth enable was not used to bootstrap BasicAuth * Clusters where template users have been assigned strong passwords after bootstrap

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Solr 10.0.0 Pas de correctif indiqué
Apache Solr 9.4 9.4.0 → 9.10.1 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Solr

Les 24 CVE de Apache Solr →
CVE-2026-22022 Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable… Non notée CVE-2026-22444 The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters,… Non notée CVE-2025-24814 Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use… Non notée CVE-2024-52012 Relative Path Traversal vulnerability in Apache Solr Non notée
Suivre cette CVE