H3-2026-0009¶

Apache Solr AuthTool Hardcoded Credentials Vulnerability

Description¶

The Apache Solr bin/solr auth enable CLI command installs undocumented user accounts with hardcoded credentials (username equals password) into every SolrCloud cluster where it is used.

Impact¶

An attacker with network access to the Solr admin API can authenticate using hardcoded credentials to gain full administrative control of the SolrCloud cluster. The most privileged account, superadmin:superadmin, grants full cluster control including security-edit, allowing an attacker to read all data, exfiltrate password hashes, create backdoor accounts, and potentially execute remote code.

References¶

• Apache Solr Security.json Hardcoded Credentials
• Apache Solr Basic Authentication Plugin
• NVD: CVE-2026-44825
• MITRE ATT&CK Technique: T1078.001: Valid Accounts: Default Accounts