CVE-2026-22444

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22444", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-07T13:29:04.129Z", "datePublished": "2026-01-21T13:40:24.979Z", "dateUpdated": "2026-01-21T15:39:04.577Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Solr", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "9.10.0", "status": "affected", "version": "8.6", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Damon Toey"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The \"create core\" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's <a target=\"_blank\" rel=\"nofollow\" href=\"https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element\">\"allowPaths\" security setting</a>.&nbsp; These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem.&nbsp; On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM \"user\" hashes.&nbsp;<br><br>Solr deployments are subject to this vulnerability if they meet the following criteria:<br><ol><li>Solr is running in its \"standalone\" mode.</li><li>Solr's \"allowPath\" setting is being used to restrict file access to certain directories.</li><li>Solr's \"create core\" API is exposed and accessible to untrusted users.&nbsp; This can happen if Solr's <a target=\"_blank\" rel=\"nofollow\" href=\"https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html\">RuleBasedAuthorizationPlugin</a> is disabled, or if it is enabled but the \"core-admin-edit\" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles.</li></ol><br>Users can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores.&nbsp; Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue."}], "value": "The \"create core\" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's \"allowPaths\" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element .\u00a0 These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem.\u00a0 On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM \"user\" hashes.\u00a0\n\nSolr deployments are subject to this vulnerability if they meet the following criteria:\n * Solr is running in its \"standalone\" mode.\n * Solr's \"allowPath\" setting is being used to restrict file access to certain directories.\n * Solr's \"create core\" API is exposed and accessible to untrusted users.\u00a0 This can happen if Solr's RuleBasedAuthorizationPlugin https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html is disabled, or if it is enabled but the \"core-admin-edit\" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles.\n\nUsers can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores.\u00a0 Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-01-21T13:40:24.979Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/qkrb9dd4xrlqmmq73lrhkbfkttto2d1m"}], "source": {"defect": ["SOLR-18058"], "discovery": "UNKNOWN"}, "title": "Apache Solr: Insufficient file-access checking in standalone core-creation requests", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/01/20/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-21T14:13:32.903Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-21T15:38:26.075172Z", "id": "CVE-2026-22444", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T15:39:04.577Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/01/20/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-21T14:13:32.903Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-22444", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T15:38:26.075172Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T15:38:41.612Z"}}], "cna": {"title": "Apache Solr: Insufficient file-access checking in standalone core-creation requests", "source": {"defect": ["SOLR-18058"], "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Damon Toey"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Solr", "versions": [{"status": "affected", "version": "8.6", "versionType": "semver", "lessThanOrEqual": "9.10.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/qkrb9dd4xrlqmmq73lrhkbfkttto2d1m", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The \"create core\" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's \"allowPaths\" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element .\u00a0 These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem.\u00a0 On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM \"user\" hashes.\u00a0\n\nSolr deployments are subject to this vulnerability if they meet the following criteria:\n * Solr is running in its \"standalone\" mode.\n * Solr's \"allowPath\" setting is being used to restrict file access to certain directories.\n * Solr's \"create core\" API is exposed and accessible to untrusted users.\u00a0 This can happen if Solr's RuleBasedAuthorizationPlugin https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html is disabled, or if it is enabled but the \"core-admin-edit\" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles.\n\nUsers can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores.\u00a0 Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue.", "supportingMedia": [{"type": "text/html", "value": "The \"create core\" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's <a target=\"_blank\" rel=\"nofollow\" href=\"https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element\">\"allowPaths\" security setting</a>.&nbsp; These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem.&nbsp; On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM \"user\" hashes.&nbsp;<br><br>Solr deployments are subject to this vulnerability if they meet the following criteria:<br><ol><li>Solr is running in its \"standalone\" mode.</li><li>Solr's \"allowPath\" setting is being used to restrict file access to certain directories.</li><li>Solr's \"create core\" API is exposed and accessible to untrusted users.&nbsp; This can happen if Solr's <a target=\"_blank\" rel=\"nofollow\" href=\"https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html\">RuleBasedAuthorizationPlugin</a> is disabled, or if it is enabled but the \"core-admin-edit\" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles.</li></ol><br>Users can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores.&nbsp; Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-01-21T13:40:24.979Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22444", "state": "PUBLISHED", "dateUpdated": "2026-01-21T15:39:04.577Z", "dateReserved": "2026-01-07T13:29:04.129Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-01-21T13:40:24.979Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Solr", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "9.10.0", "status": "affected", "version": "8.6", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*", "matchCriteriaId": "8EEA3BEF-03F1-4D74-A368-95EDEAA65966", "versionEndExcluding": "9.10.1", "versionStartIncluding": "8.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The \"create core\" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's \"allowPaths\" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element .\u00a0 These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem.\u00a0 On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM \"user\" hashes.\u00a0\n\nSolr deployments are subject to this vulnerability if they meet the following criteria:\n * Solr is running in its \"standalone\" mode.\n * Solr's \"allowPath\" setting is being used to restrict file access to certain directories.\n * Solr's \"create core\" API is exposed and accessible to untrusted users.\u00a0 This can happen if Solr's RuleBasedAuthorizationPlugin https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html is disabled, or if it is enabled but the \"core-admin-edit\" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles.\n\nUsers can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores.\u00a0 Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue."}, {"lang": "es", "value": "La API 'create core' de Apache Solr 8.6 hasta 9.10.0 carece de suficiente validaci\u00f3n de entrada en algunos par\u00e1metros de la API, lo que puede hacer que Solr compruebe la existencia e intente leer rutas del sistema de archivos que deber\u00edan ser denegadas por la configuraci\u00f3n de seguridad 'allowPaths' de Solr https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element . Estos accesos de solo lectura pueden permitir a los usuarios crear n\u00facleos utilizando conjuntos de configuraci\u00f3n (configsets) inesperados si alguno es accesible a trav\u00e9s del sistema de archivos. En sistemas Windows configurados para permitir rutas UNC, esto puede causar adicionalmente la divulgaci\u00f3n de hashes NTLM de 'usuario'.\n\nLas implementaciones de Solr est\u00e1n sujetas a esta vulnerabilidad si cumplen los siguientes criterios:\n * Solr se est\u00e1 ejecutando en su modo 'standalone'.\n * La configuraci\u00f3n 'allowPath' de Solr se est\u00e1 utilizando para restringir el acceso a archivos a ciertos directorios.\n * La API 'create core' de Solr est\u00e1 expuesta y es accesible para usuarios no confiables. Esto puede ocurrir si el RuleBasedAuthorizationPlugin de Solr https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html est\u00e1 deshabilitado, o si est\u00e1 habilitado pero el permiso predefinido 'core-admin-edit' (o un permiso personalizado equivalente) se otorga a roles de usuario de baja confianza (es decir, no administradores).\n\nLos usuarios pueden mitigar esto habilitando el RuleBasedAuthorizationPlugin de Solr (si est\u00e1 deshabilitado) y configurando una lista de permisos que impida a los usuarios no confiables crear nuevos n\u00facleos de Solr. Los usuarios tambi\u00e9n deber\u00edan actualizar a Apache Solr 9.10.1 o superior, que contienen correcciones para este problema."}], "id": "CVE-2026-22444", "lastModified": "2026-06-17T10:19:54.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22444", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-21T15:38:26.075172Z", "version": "2.0.3"}}]}, "published": "2026-01-21T14:16:06.707", "references": [{"source": "security@apache.org", "tags": ["Mailing List"], "url": "https://lists.apache.org/thread/qkrb9dd4xrlqmmq73lrhkbfkttto2d1m"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2026/01/20/5"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.solr/solr-core: Apache Solr: Insufficient file-access checking in standalone core-creation requests", "id": "2431604", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431604"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-20", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-22444", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "solr-core", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Affected", "package_name": "solr-core", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "solr-core", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2026-01-21T13:40:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-22444\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22444\nhttps://issues.apache.org/jira/browse/SOLR-18058\nhttps://lists.apache.org/thread/qkrb9dd4xrlqmmq73lrhkbfkttto2d1m"], "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-18T04:16:50.171828+00:00", "value": {"mitigation_remediation": ["Upgrade Apache Solr to version 9.10.1 or newer where the problem is resolved", "Enable the RuleBasedAuthorizationPlugin and restrict the core-admin-edit permission to trusted administrative roles", "Verify the allowPaths configuration to ensure it limits file access to intended directories", "Optionally, block external access to the create core API if the deployment does not require it."], "summary": {"action": "Patch", "impact": "Untrusted file access enabling core creation and possible NTLM hash disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects deployments of Apache Solr 8.6 to 9.10.0 that run in standalone mode, employ the allowPaths security setting to restrict file access, and expose the create core API to users who are not fully trusted. Systems that have RuleBasedAuthorizationPlugin disabled or have granted the core\u2011admin\u2011edit permission to non\u2011admin roles are particularly susceptible.", "description_and_impact": "The create core API in Apache Solr versions 8.6 through 9.10.0 does not fully validate API parameters, allowing Solr to read file-system paths that should be blocked by the allowPaths setting. This flaw can let an attacker create new core instances using arbitrary config sets that exist on the underlying filesystem, and on Windows systems configured to allow UNC paths it may also expose NTLM \"user\" hashes as part of read\u2011only file access. The consequence is that an attacker could expand deployment configuration without proper authorization and potentially obtain sensitive authentication material.", "risk_and_exploitability": "With a CVSS score of 7.1 the flaw is considered high severity. The EPSS score of less than 1% suggests a low current exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector is a remote API request to the core creation endpoint, which, if permitted to an untrusted user, can be abused. Proper authorization controls or disabling the vulnerable API are required to mitigate this risk. The solution is a patch or upgrade to a version where the issue is fixed."}}}}, "created": "2026-01-22T10:15:15.501949+00:00", "updated": "2026-04-18T04:30:35.822022+00:00", "vendors": ["apache", "apache$PRODUCT$solr"]}