CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-44825

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue. Not affected: * Clusters where bin/solr auth enable was not used to bootstrap BasicAuth * Clusters where template users have been assigned strong passwords after bootstrap

Score
8.1 high
Published
2026-06-01
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
textproc/apache-solrapache-solr10.0.0_1,1unaddressedmfechner@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>apache-solr</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hardcoded credentials in the Basic Authentication setup tool (bin/solr
	auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0
	allows a remote attacker to gain full administrative access to the
	cluster via publicly known default credentials installed silently
	alongside the user-specified account. 

As an immediate workaround
	without upgrading, delete the template users (superadmin, admin,
	search, index) from security.json or change their passwords.
The
	future, not yet released, versions 9.11.0 and 10.1.0 will not be
	vulnerable, and it will be enough to upgrade to solve the issue.

Not
	affected:
  *  Clusters where bin/solr auth enable was not used to
	bootstrap BasicAuth
  *  Clusters where template users have been
	assigned strong passwords after bootstrap</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-44825</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-44825</url>
    </references>
    <dates>
      <discovery>2026-06-01</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>