What is the CVSS score of EUVD-2026-33602?

EUVD-2026-33602 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Solr are affected by EUVD-2026-33602?

Apache Solr 9.4.0-10.0.0 contains hardcoded default administrative credentials that are silently installed alongside user-configured accounts, allowing remote attackers to gain full administrative…

How to fix or mitigate EUVD-2026-33602?

24 hours: Identify all Solr deployments running versions 9.4.0-9.10.1 or 10.0.0; confirm if Basic Authentication is enabled during bootstrap; review logs for unauthorized access attempts using template accounts (superadmin, admin, search, index). 7 days: Immediately change all template account credentials to strong unique passwords or disable accounts entirely; implement network-level access restrictions limiting Solr cluster connectivity to authorized networks only; enable comprehensive audit logging for administrative actions. 30 days: Monitor Apache Solr security advisories for patch availability; plan and execute upgrade to patched version upon release; conduct security assessment of Solr access controls and authentication mechanisms.

Apache Solr EUVD-2026-33602

| CVE-2026-44825 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-06-01 security@apache.org

GHSA-qhr7-h655-pw6r

Apache Authentication Bypass

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 09:31 vuln.today

CVE Published

Jun 01, 2026 - 09:16 nvd

HIGH 8.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

20 maven packages depend on org.apache.solr:solr-core (18 direct, 2 indirect)

Ecosystem-wide dependent count for version 9.4.0.

DescriptionCVE.org

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.

As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.

Not affected:

Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
Clusters where template users have been assigned strong passwords after bootstrap

AnalysisAI

Hardcoded credentials in Apache Solr 9.4.0 through 9.10.1 and 10.0.0 allow remote attackers to obtain full administrative access to clusters that bootstrapped Basic Authentication via the bin/solr auth enable tool. The setup script silently installs template accounts (superadmin, admin, search, index) with publicly known default passwords alongside the user-specified account, and no public exploit identified at time of analysis though the credentials are documented and trivially reusable.

Technical ContextAI

Apache Solr is an open-source enterprise search platform built on Lucene, widely deployed for indexing and full-text search. Its Basic Authentication plugin stores users in security.json under each node's Zookeeper-coordinated configuration. The bin/solr auth enable convenience tool bootstraps this file but, per the vendor advisory, also writes a fixed set of template accounts (superadmin, admin, search, index) using credentials that are embedded in the tool itself. This is a textbook CWE-798 Use of Hard-coded Credentials weakness: the secret material is shipped in code/distribution rather than generated per-deployment, so knowledge of the Solr version effectively equals knowledge of administrator credentials.

RemediationAI

Patch availability: upcoming versions 9.11.0 and 10.1.0 will not be vulnerable and upgrading will fully resolve the issue, but at time of analysis these releases are not yet published, so the status is best characterized as no vendor-released patch identified at time of analysis with fixed versions pre-announced. As an immediate workaround per Apache, edit security.json to delete the template users superadmin, admin, search, and index, or assign each of them strong unique passwords; deletion is safer if those accounts are unused, while password rotation preserves any roles already bound to them and avoids breaking automation that may reference those usernames. In addition, restrict network exposure of the Solr admin API to trusted management networks and audit access logs for prior authentications by the template accounts to detect any predating compromise. Refer to the vendor announcement at https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch for authoritative guidance.