Loading vulnerability…
CVE-2026-44825 is a hardcoded credentials vulnerability in Apache Solr affecting versions 9.4.0 through 9.10.1 and 10.0.0. The flaw is in the Basic Authentication bootstrap workflow invoked through the bin/solr auth enable command. In affected deployments, the setup process silently provisions additional template BasicAuth users alongside the administrator account specified by the operator, and those template accounts are created with publicly known default credentials. This can expose SolrCloud or other Solr cluster deployments to unauthorized access when the administrative interface is reachable. The issue affects only clusters where the vulnerable bootstrap command was used to enable Basic Authentication and where the silently created template accounts were left unchanged after setup.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Go-based Apache Solr scanner/exploitation utility centered in a single code file, solr_main.go, with README documentation and a .gitignore. It is not part of a larger exploit framework. The code implements an HTTP(S)-based scanner for Apache Solr instances associated with CVE-2026-44825, described in the repository as a Velocity Template RCE issue. Targets are normalized to include a /solr base path, then probed over the network using GET and POST requests. The scanner supports single-target mode and bulk scanning from a file, uses configurable concurrency and timeout settings, and writes structured JSON results. Operationally, the tool goes beyond passive detection. It includes authentication testing and credential discovery logic using built-in candidate usernames (superadmin, admin, search, index) and passwords (SolrRocks, solr, Solr123, admin, password, changeme, secret, solradmin). When credentials are found or supplied, the tool can attempt an RCE workflow and also launch an interactive shell-like mode for repeated command execution. In the visible main flow, the default exploit verification command is 'id; hostname; uname -a', indicating command execution on a Unix-like target. Notable implementation details visible in the code include disabled TLS certificate verification (InsecureSkipVerify: true), redirect limiting, custom User-Agent strings, URL validation/normalization, and helper routines for GET/POST requests and bounded response reading. The README and code together indicate the main capabilities are: Solr endpoint detection, version extraction, auth exposure checks, default credential attempts, optional exploitation, and interactive authenticated RCE. Given these features, this is a real exploit-capable tool rather than a pure detector. Its maturity is best classified as OPERATIONAL: it contains a hardcoded verification payload and interactive command execution support, but it is a standalone utility rather than a reusable weaponized framework module.
Repository is a small Python-based Apache Solr scanner/exploit tool centered on solr_scanner.py, with supporting README, banner asset, and requirements file. The script is not part of a larger exploit framework. Its workflow is: normalize target URLs to include /solr, probe /admin/info/system for Solr identification and version extraction, test whether admin endpoints require Basic Auth, brute-force a short built-in credential list against detected Solr instances, enumerate collections/cores, and optionally exploit the first discovered collection via a POST to /<collection>/select using wt=velocity and a custom Velocity template that calls java.lang.Runtime.exec(). It supports single-target scan, file-based mass scanning with 30-thread concurrency, automatic exploitation of hosts where credentials were found, and an interactive command shell mode. The code writes vulnerable findings to JSON output. Notable hardcoded artifacts include default usernames [superadmin, admin, search, index], passwords [SolrRocks, solr, Solr123, admin, password, changeme, secret, solradmin], fallback collection names [gettingstarted, test], and demonstration commands such as 'id; hostname; whoami' and 'id; hostname; uname -a'. Overall, this is an operational authenticated web/network exploit tool with built-in reconnaissance and post-auth RCE capability against the claimed Solr Velocity template injection issue.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A hardcoded credentials vulnerability affecting Apache Solr.
A hardcoded/default credentials vulnerability in Apache Solr's Basic Authentication setup tool that can allow remote attackers to gain full administrative access to affected clusters.
A hardcoded credentials vulnerability in Apache Solr’s Basic Authentication setup workflow that can create undocumented template users with publicly known default credentials, potentially allowing remote administrative access to a SolrCloud cluster.
A high-severity hardcoded-credentials and insecure-defaults vulnerability in Apache Solr's bin/solr auth enable bootstrapping tool that silently creates additional template accounts with publicly known default credentials, enabling unauthorized administrative access to affected Solr clusters.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.