Apache Software Foundation Apache Solr
24 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-44825 | 9.4.0 – 9.10.1 ; 10.0.0 | Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users | CRITICAL 9.8 | 3.9 % | ||
| CVE-2026-22022 | 5.3 – 9.10.0 | Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin | HIGH 8.2 | 0.6 % | ||
| CVE-2026-22444 | 8.6 – 9.10.0 | Apache Solr: Insufficient file-access checking in standalone core-creation requests | HIGH 7.1 | 0.7 % | ||
| CVE-2025-24814 | ≤ 9.7 | Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files | MEDIUM 5.5 | 1.2 % | ||
| CVE-2024-52012 | 6.6 – 9.7.0 | Apache Solr: Configset upload on Windows allows arbitrary path write-access | MEDIUM 5.4 | 41 % | ||
| CVE-2024-45217 | 6.6.0 – < 8.11.4 ; 9.0.0 – < 9.7.0 | Apache Solr: ConfigSets created during a backup restore command are trusted implicitly | HIGH 8.1 | 0.7 % | ||
| CVE-2024-45216 | 5.3.0 – < 8.11.4 ; 9.0.0 – < 9.7.0 | Apache Solr: Authentication bypass possible using a fake URL Path ending | CRITICAL 9.8 | 93 % | ||
| CVE-2023-50291 | 6.0.0 – 8.11.2 ; 9.0.0 – < 9.3.0 | Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords | HIGH 7.5 | 3.3 % | ||
| CVE-2023-50292 | 8.10.0 – 8.11.2 ; 9.0.0 – < 9.3.0 | Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users | HIGH 7.5 | 3.0 % | ||
| CVE-2023-50298 | 6.0.0 – 8.11.2 ; 9.0.0 – < 9.4.1 | Apache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions | HIGH 7.5 | 1.6 % | ||
| CVE-2023-50386 | 6.0.0 – 8.11.2 ; 9.0.0 – < 9.4.1 | Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets | HIGH 8.8 | 84 % | ||
| CVE-2023-50290 | 9.0.0 – < 9.3.0 | Apache Solr: Host environment variables are published via the Metrics API | MEDIUM 6.5 | 68 % | ||
| CVE-2021-44548 | unspecified – < 8.11.1 | Apache Solr information disclosure vulnerability through DataImportHandler | CRITICAL 9.8 | 5.2 % | ||
| CVE-2021-29943 | Apache Solr – < 8.8.2 | Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections | CRITICAL 9.1 | 4.7 % | ||
| CVE-2021-29262 | Apache Solr – < 8.8.2 | Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings | HIGH 7.5 | 6.7 % | ||
| CVE-2021-27905 | Apache Solr – < 8.8.2 | SSRF vulnerability with the Replication handler | CRITICAL 9.8 | 93 % | ||
| CVE-2017-3164 | Apache Solr 1.3.0 to 1.4.1, 3.1.0 to 3.6.2, 4.0.0 to 4.10.4, 5.0.0 to 5.5.5, 6.0.0 to 6.6.5, 7.0.0 to 7.6.0 | Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding w | HIGH 7.5 | 19 % | ||
| CVE-2019-0192 | Apache Solr 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5 | In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By po | CRITICAL 9.8 | 78 % | ||
| CVE-2018-8026 | 6.0.0 to 6.6.4 ; 7.0.0 to 7.3.1 | This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files ( | MEDIUM 5.5 | 9.0 % | ||
| CVE-2018-8010 | Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 | This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (sol | MEDIUM 5.5 | 3.7 % | ||
| CVE-2018-1308 | 1.2 to 6.6.2 ; 7.0.0 to 7.2.1 | This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inl | HIGH 7.5 | 21 % | ||
| CVE-2017-9803 | 6.2.0 to 6.6.0 | Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end- | HIGH 7.5 | 2.2 % | ||
| CVE-2017-3163 | 1.4.0 to 5.5.3 ; 6.0.0 to 6.4.0 | When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a | HIGH 7.5 | 6.6 % | ||
| CVE-2017-7660 | 5.3 to 5.5.4 ; 6.0 to 6.5.1 | Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially cra | HIGH 7.5 | 5.6 % |