High · published January 21, 2026
⚡ A simple lack of input validation in Apache Solr could let untrusted users create unexpected cores — it’s like handing someone the recipe for your secret sauce without checking their credentials! 🔥 Think of Solr's access controls as a bouncer at a club. If the bouncer isn’t checking IDs properly, anyone could waltz in and throw a wild party in a VIP room they shouldn’t access! This flaw could allow an attacker to create Solr cores using configuration sets they shouldn't have access to or even expose sensitive NTLM user hashes on Windows systems configured to allow UNC paths. Imagine an unauthorized guest throwing chaos into your carefully curated space — absolutely devastating!
Think of Solr's access controls as a bouncer at a club. If the bouncer isn’t checking IDs properly, anyone could waltz in and throw a wild party in a VIP room they shouldn’t access! The vulnerability in Apache Solr's 'create core' API allows insufficiently validated parameters to let unauthorized file system paths be accessed. This can lead to the creation of unauthorized cores with potentially dangerous configuration sets.
This flaw could allow an attacker to create Solr cores using configuration sets they shouldn't have access to or even expose sensitive NTLM user hashes on Windows systems configured to allow UNC paths. Imagine an unauthorized guest throwing chaos into your carefully curated space — absolutely devastating! To mitigate this, enable the RuleBasedAuthorizationPlugin to restrict permissions for core creation and ensure untrusted users can't access it. Don’t forget to upgrade to Apache Solr version 9.10.1 or greater, which includes the necessary fixes! You've got this! Follow these steps, and you’ll be well on your way to securing your Solr environment! 🛡️