CVE-2026-22022
📋 TL;DR
Apache Solr deployments using RuleBasedAuthorizationPlugin with specific configurations are vulnerable to unauthorized API access. Attackers can bypass authorization controls to read sensitive configuration, schema, metrics, or security data. Only deployments meeting all five criteria listed in the description are affected.
💻 Affected Systems
- Apache Solr
📦 What is this software?
Solr by Apache
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users gain read access to sensitive Solr configuration, schema, metrics, and security data, potentially exposing system information and configuration details.
Likely Case
Information disclosure of Solr configuration and system metrics, which could aid further attacks or expose sensitive deployment details.
If Mitigated
With proper controls like network filtering or the 'all' permission configured, the vulnerability is effectively neutralized.
🎯 Exploit Status
Exploitation requires sending HTTP requests to vulnerable Solr endpoints. No authentication needed if network access exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Solr 9.10.1
Vendor Advisory: https://lists.apache.org/thread/d59hqbgo7p62myq7mgfpz7or8n1j7wbn
Restart Required: Yes
Instructions:
1. Download Solr 9.10.1 or later from Apache Solr website. 2. Backup current Solr installation and data. 3. Stop Solr service. 4. Replace Solr binaries with patched version. 5. Restart Solr service. 6. Verify functionality.
🔧 Temporary Workarounds
Add 'all' permission to security.json
allModify RuleBasedAuthorizationPlugin configuration to include the 'all' pre-defined permission assigned to admin/privileged roles
Edit security.json to add: {"name": "all", "role": "admin"} to permissions array
🧯 If You Can't Patch
- Implement network-level controls to restrict direct access to Solr APIs
- Review and modify RuleBasedAuthorizationPlugin configuration to remove vulnerable permission rules
🔍 How to Verify
Check if Vulnerable:
Check if using Solr 5.3.0-9.10.0, review security.json for RuleBasedAuthorizationPlugin configuration meeting all vulnerability criteriaCheck Version:
curl http://solr-host:8983/solr/admin/info/system | grep solr-spec-versionVerify Fix Applied:
After upgrade to 9.10.1+, verify version and test that unauthorized API access attempts are properly blocked📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /solr/admin/config, /solr/admin/schema, /solr/admin/metrics, or /solr/admin/security endpoints
Network Indicators:
- HTTP requests to Solr admin APIs from unauthorized sources
SIEM Query:
source_ip NOT IN authorized_ips AND dest_port=8983 AND (uri_path CONTAINS '/solr/admin/config' OR uri_path CONTAINS '/solr/admin/schema' OR uri_path CONTAINS '/solr/admin/metrics' OR uri_path CONTAINS '/solr/admin/security')