Vulnerability Directory | CVE-2026-22444 | Apache Solr & Lucene

Overview

Apache Solr is an open-source search platform built on Apache Lucene, designed for scalable, high-performance search and indexing. It supports full-text search, faceted search, real-time indexing, distributed searching, and high availability. Solr is widely used in applications requiring fast and efficient search capabilities, such as e-commerce, enterprise search, and log analytics.

A Improper Access Control vulnerability (CVE-2026-22444) has been identified in the FileSystemConfigSetService component. This vulnerability allows attackers to load malicious code as a plugin.

Per the Open Web Application Security Project (OWASP): "Improper Access Control occurs when an application does not properly restrict access to resources or functionality, allowing unauthorized users to perform actions beyond their intended permissions."

This issue affects versions below 9.8.0

‍

Details

Module Info

Product: Apache Solr
Affected packages: solr-core
Affected versions: <9.8.0
GitHub repository: https://github.com/apache/solr

Published packages: https://central.sonatype.com/artifact/org.apache.solr/solr-core

Package manager: Maven
Fixed in: NES for Solr v8.11.6

‍

Vulnerability Info

A security vulnerability has been identified in Apache Solr affecting authorization mechanisms in admin handlers. The flaw involves insufficient file-access checking in standalone core-creation requests, which could allow unauthorized operations. The fix includes security patches to SchemaHandler, SolrConfigHandler, and other admin handlers with enhanced permission validation and HTTP method checking.

To mitigate this risk, users should ensure authentication and authorization are enabled and that admin handlers are properly secured. The fix addresses path and permission related NPEs and includes comprehensive security tests.

‍

Mitigation

Apache Solr versions below or equal to 8.11.4 are no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations: