/Vulnerability Library

Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials

CVE-2026-44825
Verified

Description

Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users.

Severity

High

CVSS Score

8.1

Exploit Probability

3%

Published Date

July 29, 2026

Template Author

pdteam, 0x_akoko

CVE-2026-44825.yaml
8.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-44825
CWE ID:
cwe-798

References

https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7chhttp://www.openwall.com/lists/oss-security/2026/05/29/6https://github.com/shinthink/solrradarhttps://nvd.nist.gov/vuln/detail/CVE-2026-44825

Remediation Steps

Upgrade to versions 9.11.0, 10.1.0 or later; alternatively, delete template users or change their passwords in security.json.