CVE-2026-44825 Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users

🗓️ 01 Jun 2026 08:02:15Reported by apacheType

Hardcoded credentials in Solr BasicAuth enable remote admin access; upgrade to fixed versions or remove template users.

Reporter	Title	Published	Views	Family All 23
ATTACKERKB	CVE-2026-44825	1 Jun 202608:02	–	attackerkb
BDU FSTEC	The vulnerability of the command-line utility bin/solr auth for the Apache Solr search server allows a perpetrator to escalate their privileges and gain unauthorized access to protected information.	29 Jun 202600:00	–	bdu_fstec
Circl	CVE-2026-44825	29 May 202621:32	–	circl
CNNVD	Apache Solr 安全漏洞	1 Jun 202600:00	–	cnnvd
CVE	CVE-2026-44825	1 Jun 202608:02	–	cve
GithubExploit	Exploit for Insecure Default Initialization of Resource in Apache Solr	8 Jul 202616:51	–	githubexploit
GithubExploit	Exploit for Insecure Default Initialization of Resource in Apache Solr	3 Jul 202623:24	–	githubexploit
Debian CVE	CVE-2026-44825	1 Jun 202608:02	–	debiancve
EUVD	EUVD-2026-33602	1 Jun 202608:02	–	euvd
Github Security Blog	Apache Solr has hardcoded credentials in the Basic Authentication setup tool	1 Jun 202609:31	–	github

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.solr:solr-core",
    "product": "Apache Solr",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "9.10.1",
        "status": "affected",
        "version": "9.4.0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "10.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch

01 Jun 2026 08:02Current

CVSS 3.18.1

EPSS0.00529