Executive brief
Apache Solr is a popular open-source search platform used to index and search large volumes of data. A security flaw in its authentication setup tool creates hidden, administrative accounts with well-known default passwords when a user enables basic security. An attacker can use these secret accounts to gain full control over the search cluster, potentially leading to the theft or modification of sensitive indexed data.
Technical details
A Use of Hard-coded Credentials (CWE-798) vulnerability exists in the Apache Solr 'bin/solr auth enable' CLI tool. When this tool is used to bootstrap Basic Authentication, it silently installs several template accounts (superadmin, admin, search, index) with publicly known default credentials alongside the user-defined account. A remote attacker can exploit these credentials to gain full administrative access to the Solr cluster. The vulnerability affects versions 9.4.0 through 9.10.1 and 10.0.0. Users are advised to manually delete these template users from security.json or change their passwords until patches 9.11.0 or 10.1.0 are released.
Affected products
- Apache Solr 9.4.0 through 9.10.1, 10.0.0
Timeline
- 2026-05-29: disclosed: Initial disclosure on oss-security mailing list
- 2026-06-01: advisory: GitHub and NVD advisory published