Loading story…
Apache disclosed CVE-2026-44825, a high-severity flaw in Apache Solr’s Basic Authentication bootstrap process that can leave clusters open to full remote administrative takeover. In affected versions, running the BasicAuth setup command
bin/solr auth enable
silently creates additional template accounts with publicly known default credentials alongside the administrator account chosen by the operator.
The issue affects Solr 9.4.0 through 9.10.1 and 10.0.0 and is tracked as SOLR-18233. Apache said deployments are at risk if they used the CLI to enable BasicAuth and left the template users unchanged; the exposed accounts include superadmin, admin, search, and index in security.json. As an immediate mitigation, administrators should remove those users or assign strong passwords, while fixes are expected in 9.11.0 and 10.1.0. The vulnerability was reported by Naveen Sunkavally of Horizon3.ai.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
Apache disclosed CVE-2026-44825, a high-severity hardcoded-credentials vulnerability in Apache Solr's Basic Authentication setup tool. The issue affects Solr 9.4.0 through 9.10.1 and 10.0.0 when `bin/solr auth enable` creates additional template users with publicly known credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcehorizon3.ai
Open sourcecvefeed.io
Open sourceopenwall.com
Open sourceseclists.org
Open sourcelists.apache.org
Open sourceissues.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-49268**, a high-severity LDAP Distinguished Name injection flaw in Apache Shiro’s `DefaultLdapRealm` that can let remote attackers manipulate LDAP bind authentication. The vulnerability is caused by directly concatenating user-supplied usernames into an LDAP DN template without escaping RFC 2253 special characters, allowing an attacker to alter DN construction and potentially bypass authentication or impersonate legitimate users. The issue carries a **CVSS v4 score of 8.8** and is considered remotely exploitable. The flaw affects Apache Shiro `shiro-core` through **2.2.0** and **3.0.0-alpha-0** through **3.0.0-alpha-1** when `DefaultLdapRealm` is in use. Apache said organizations should identify deployments using that realm and upgrade to **2.2.1** or **3.0.0-alpha-2** or later; input escaping for usernames is also recommended. The advisory credited **zhaokaifei of ChinaTelecom** with reporting the issue and **Lenny Primak** with developing the fix.
Jun 29, 2026
Apache disclosed **CVE-2026-48911**, a moderate-severity vulnerability in Apache Answer affecting versions through **2.0.1** that can let an unauthenticated attacker take over arbitrary user accounts. The flaw stems from insufficient verification of data authenticity caused by a missing authorization check in the external-login email-binding confirmation flow, allowing abuse of the existing user confirmation process. According to the disclosure, exploitation requires tricking a victim into clicking a crafted confirmation link, after which the attacker can bind access and seize the targeted account. Apache said the issue is fixed in **Apache Answer 2.0.2** and urged users to upgrade; the vulnerability was credited to researchers **tonghuaroot** and **yangxi**.
Aug 5, 2026
Apache Syncope disclosed three vulnerabilities in its identity-management platform that can allow authorized administrators with applicable entitlements to manipulate backend databases through SQL injection, bypass the Groovy sandbox to execute code in the application context, or reuse JWT access tokens to impersonate more privileged users. Affected versions span the 3.0, 4.0, and 4.1 release branches, including 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, depending on the vulnerable component. Organizations should upgrade to Apache Syncope **4.0.8** or **4.1.3**, review privileged-user and REST API activity, and investigate anomalous Task-search queries or other suspicious database behavior. Administrators should also rotate potentially exposed JWTs to reduce the risk of token reuse and privilege impersonation.
Sep 16, 2026