Auth bypass in Apache Solr
CVE-2026-22022
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input validation in those components. …
EPSS: 0.005 (39.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Apache Solr
- Apache Software Foundation Solr — versions 5.3
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-22022?
- CVE-2026-22022 is a high-severity vulnerability in Apache Solr, classified under Improper Authorization. CVSS score: 8.2/10. Published 2026-01-21.
- How severe is CVE-2026-22022?
- High severity. CVSS v3 base score is 8.2 out of 10.