Hardcoded Credentials in Apache Solr BasicAuth Setup (CVE-2026-44825)

Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 contain hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable). A remote attacker can gain full administrative access to the cluster using publicly known default credentials installed alongside the user-specified account. Workarounds include deleting template users from security.json or changing their passwords. Affected versions: - 9.4.0 through 9.10.1 - 10.0.0 We recommend updating to: 9.11.0, 10.1.0. CVSS 9.8 · our assessment: act_now Reference: https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch Details: https://vuln.today/cve/CVE-2026-44825