SB2026012211 - Multiple vulnerabilities in Apache Solr

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper authorization (CVE-ID: CVE-2026-22022)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to improper input validation in the Rule Based Authorization Plugin. A remote authenticated user can bypass certain "predefined permission" rules in the RuleBasedAuthorizationPlugin under specific configurations and gain unauthorized access to the application. 

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-22444)

The vulnerability allows a remote user to bypass implemented security restriction.

The vulnerability exists due to insufficient input validation on certain API parameters. A remote authenticated user can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's  "allowPaths" security setting. These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem.  On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM "user" hashes. 

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/thread/mr1ch0r17jybfv0jy78ry8o21hns340z
• https://lists.apache.org/thread/py5qp5kx2ovj943cpoctcfd0p2tonkjc