CVE-2026-44825 is a high severity hardcoded credentials flaw (CVSS 8.1) in Apache Solr 9.4.0 through 9.10.1 and 10.0.0. The bin/solr auth enable tool silently adds publicly known default users next to yours. Delete the template users from security.json or change their passwords.
What's affected
From the Apache announcement:
- Affected: Solr 9.4.0 through 9.10.1, and 10.0.0.
- Fixed: the announcement says the not yet released versions 9.11.0 and 10.1.0 will not be vulnerable. Check the Apache announcement for the release status before you plan.
Not affected, per the same announcement: clusters where bin/solr auth enable was not used to bootstrap Basic Authentication, and clusters where the template users have been given strong passwords after bootstrap.
The template users are named superadmin, admin, search and index. If your cluster was set up with the tool and nobody changed them, assume the defaults are live.
How to check if you're exposed
Look at the security configuration for the four template users. In SolrCloud it lives in ZooKeeper, and in standalone mode in the Solr home folder. Fetch it with your usual method, for example the Solr zk copy command or by reading the file, and check the credentials section:
grep -E "superadmin|admin|search|index" security.json
If those names are present and you did not set their passwords yourself, test with a known good procedure from your security team, and change them. Also check your setup scripts and runbooks for use of the auth enable command.
What to do now
- Delete the template users superadmin, admin, search and index from security.json, or set strong unique passwords for them. This is the workaround in the announcement.
- Confirm that the account you created yourself still has the roles you need before you remove the others.
- Limit network access to the Solr admin port to trusted hosts.
- Review Solr logs for logins by the template users and for unexpected configuration or collection changes.
- Upgrade to a fixed release once the Apache announcement shows it is available.
Why it matters
The record lists CWE-798 (use of hard coded credentials) and CWE-1188 (insecure default initialization of a resource). A setup tool meant to turn on security quietly created four extra accounts with the same credentials for everyone who ran it, so the result was a cluster that looked protected but had a known way in.
This kind of flaw is easy to miss in review because the account you chose works as expected. Only an audit of the security file reveals the extras.
The record does not mark this CVE as KEV. Treat any Solr cluster bootstrapped with the tool as exposed until the template users are gone.
Quick check
Is changing the passwords enough?
The announcement offers deleting the template users or changing their passwords as an immediate workaround, and upgrade as the full fix.
Sources
Last reviewed: 19 October 2026.
