{"answers":{"affected":"5 open source packages ship an affected version, including org.apache.solr:solr-core and solr. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44825 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2026-44825 is a high-severity vulnerability in Apache Solr, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-44825 and fix it if it is affected.\n\nWhat it is: CVE-2026-44825 is a high-severity vulnerability in Apache Solr, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44825 exists.\n\nAffected packages and fixed versions:\n- org.apache.solr:solr-core (Maven): affected all versions; no fix listed\n- org.apache.solr:solr-core (Maven): affected all versions; no fix listed\n- org.apache.solr:solr-core (Maven): affected from 9.4.0 up to 9.10.1; no fix listed\n- org.apache.solr:solr-core (Maven): affected from 9.4.0 up to 9.10.1; no fix listed\n- solr (Bitnami): affected from 9.4.0 up to 10.0.0; fixed in 10.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-44825/ (Markdown: https://insights.sbomify.com/CVE-2026-44825/index.md)","id":"CVE-2026-44825","markdown":"https://insights.sbomify.com/CVE-2026-44825/index.md","name":"CVE-2026-44825","record":{"aliases":["BIT-solr-2026-44825","CLEANSTART-2026-MT16431","GHSA-qhr7-h655-pw6r","MINI-8gm8-24vv-95c9"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["privilege_escalation","code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Apache Solr search engine","requires_auth":"none","summary":"Remote attackers can gain full administrative access to Apache Solr clusters using hardcoded default credentials created by the BasicAuth setup tool.","user_interaction":"not_required","vuln_class":"hardcoded_credentials"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"solr","vendor":"apache"}],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-798","name":"Use of Hard-coded Credentials"},{"id":"CWE-1188","name":"Initialization of a Resource with an Insecure Default"}],"description":"Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. \n\nAs an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords.\nThe future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.\n\nNot affected:\n  *  Clusters where bin/solr auth enable was not used to bootstrap BasicAuth\n  *  Clusters where template users have been assigned strong passwords after bootstrap","ecosystems":["Bitnami","Maven"],"exploits":{"exploitdb":0,"first_seen":"2026-07-03","github_poc":3,"max_poc_stars":12,"metasploit":0,"nuclei":1,"refs":[{"date":"2026-07-08T16:51:16Z","kind":"github_poc","ref":"https://github.com/gagaltotal/CVE-2026-44825-Apache-Solr-Scanner","stars":12,"title":"Apache Solr instances that may be affected by CVE-2026-44825, related to Velocity Template Remote Code Execution (RCE) conditions."},{"date":"2026-07-03T23:24:25Z","kind":"github_poc","ref":"https://github.com/shinthink/solrradar","stars":5,"title":"☄️ Mass reconnaissance \u0026 exploitation framework for Apache Solr CVE-2026-44825 — Velocity template injection to RCE"},{"date":"2026-10-15T01:01:16Z","kind":"github_poc","ref":"https://github.com/q0524/CVE-2026-44825_CTF","stars":0,"title":null},{"date":null,"kind":"nuclei","ref":"http/cves/2026/CVE-2026-44825.yaml","stars":null,"title":"Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials"}],"tier":"weaponised"},"has_fix":true,"headline":"Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users","id":"CVE-2026-44825","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"hardcoded_credentials","year":"2026"},"n_packages":5,"n_references":1,"next":{"headline":"Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals","id":"CVE-2026-44826"},"packages":[{"ecosystem":"Bitnami","fixed":["10.0.0"],"introduced":["9.4.0","10.0.0"],"last_affected":["10.0.0"],"package":"solr","purl":"pkg:bitnami/solr","source":"BIT-solr-2026-44825"},{"ecosystem":"Maven","fixed":[],"introduced":[],"last_affected":[],"package":"org.apache.solr:solr-core","purl":null,"source":"GHSA-qhr7-h655-pw6r"},{"ecosystem":"Maven","fixed":[],"introduced":[],"last_affected":[],"package":"org.apache.solr:solr-core","purl":"pkg:maven/org.apache.solr/solr-core","source":"GHSA-qhr7-h655-pw6r"},{"ecosystem":"Maven","fixed":[],"introduced":["9.4.0"],"last_affected":["9.10.1"],"package":"org.apache.solr:solr-core","purl":null,"source":"GHSA-qhr7-h655-pw6r"},{"ecosystem":"Maven","fixed":[],"introduced":["9.4.0"],"last_affected":["9.10.1"],"package":"org.apache.solr:solr-core","purl":"pkg:maven/org.apache.solr/solr-core","source":"GHSA-qhr7-h655-pw6r"}],"prev":{"headline":"Microsoft Office Remote Code Execution Vulnerability","id":"CVE-2026-44824"},"products":["Apache Solr"],"published":"2026-06-01","related":[{"cvss_score":7.5,"headline":"Apache Solr VelocityResponseWriter Plug-In Remote Code Execution","id":"CVE-2019-17558","kev_date_added":"2021-11-03","published":"2019-12-30"},{"cvss_score":7.2,"headline":"Apache Solr DataImportHandler Code Injection","id":"CVE-2019-0193","kev_date_added":"2021-12-10","published":"2019-08-01"},{"cvss_score":9.8,"headline":"Apache Solr: Authentication bypass possible using a fake URL Path ending","id":"CVE-2024-45216","kev_date_added":null,"published":"2024-10-16"},{"cvss_score":9.8,"headline":"Apache Solr information disclosure vulnerability through DataImportHandler","id":"CVE-2021-44548","kev_date_added":null,"published":"2021-12-23"},{"cvss_score":9.8,"headline":"SSRF vulnerability with the Replication handler","id":"CVE-2021-27905","kev_date_added":null,"published":"2021-04-13"},{"cvss_score":9.8,"headline":"Incorrect Authorization in Apache Solr","id":"CVE-2020-13957","kev_date_added":null,"published":"2020-10-13"},{"cvss_score":9.8,"headline":"Unrestricted upload of file with dangerous type in Apache Solr","id":"CVE-2019-12409","kev_date_added":null,"published":"2019-11-18"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-06-02","vendors":["Apache Software Foundation"]},"summary":"Remote attackers can gain full administrative access to Apache Solr clusters using hardcoded default credentials created by the BasicAuth setup tool.","url":"https://insights.sbomify.com/CVE-2026-44825/"}