CVE-2026-22444: Apache Solr Information Disclosure Flaw

CVE-2026-22444 Overview

CVE-2026-22444 is a high-severity input validation vulnerability affecting Apache Solr's "create core" API. The vulnerability exists in Apache Solr versions 8.6 through 9.10.0, where insufficient input validation on certain API parameters allows attackers to bypass Solr's allowPaths security restrictions. This flaw enables unauthorized read-only access to restricted file system paths, potentially allowing creation of cores using unexpected configsets and, on Windows systems with UNC path support, disclosure of NTLM user hashes.

Critical Impact

Attackers with access to Solr's "create core" API can bypass file system path restrictions, potentially exfiltrating sensitive configuration data and NTLM hashes on Windows systems.

Affected Products

• Apache Solr 8.6 through 9.10.0
• Apache Solr deployments running in "standalone" mode
• Solr instances with allowPath restrictions configured

Discovery Timeline

• 2026-01-21 - CVE-2026-22444 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-22444

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in Apache Solr's "create core" API endpoint. The API accepts parameters that specify file system paths for core configuration, but fails to adequately validate these inputs against Solr's allowPaths security mechanism. This security control is designed to restrict Solr's file system access to predetermined directories, but the vulnerable API bypasses these checks.

The vulnerability is particularly severe in three scenarios: when Solr operates in standalone mode, when allowPath restrictions are actively configured, and when the "create core" API is accessible to untrusted users. The latter condition occurs if Solr's RuleBasedAuthorizationPlugin is disabled or misconfigured to grant the core-admin-edit permission to non-admin user roles.

On Windows systems configured to allow UNC paths, exploitation can lead to NTLM hash disclosure through forced authentication to attacker-controlled SMB servers—a classic NTLM relay attack vector that can enable further credential-based attacks.

Root Cause

The root cause is insufficient input validation (CWE-20) in the "create core" API parameter handling. The validation logic fails to properly sanitize and verify file system paths against the allowPaths security configuration, allowing attackers to specify paths that should be restricted. This represents a gap between the intended security model and its actual implementation.

Attack Vector

The attack exploits the network-accessible "create core" API endpoint, requiring only low-privilege authenticated access (or no authentication if RuleBasedAuthorizationPlugin is disabled). An attacker can craft malicious API requests with carefully constructed path parameters that bypass the allowPaths restrictions.

The attack flow involves:

1. Identifying a Solr instance running in standalone mode with the "create core" API exposed
2. Crafting API requests with path parameters designed to reference restricted directories
3. Leveraging the read-only access to discover accessible configsets outside allowed paths
4. On Windows targets, using UNC paths to force NTLM authentication to attacker-controlled servers, capturing hash credentials for offline cracking or relay attacks

Detection Methods for CVE-2026-22444

Indicators of Compromise

• Unusual "create core" API requests with path parameters referencing directories outside normal Solr data paths
• Solr core creation attempts using unexpected or non-standard configsets
• On Windows systems, outbound SMB connections from the Solr process to external or unknown hosts
• Authentication logs showing repeated core-admin-edit operations from non-admin accounts

Detection Strategies

• Monitor Solr access logs for anomalous "create core" API calls, particularly those with path traversal sequences or UNC path patterns
• Implement network monitoring to detect outbound SMB traffic (ports 139, 445) originating from Solr servers
• Configure alerting for core creation events referencing configsets outside standard directories
• Review authorization plugin configurations to identify overly permissive core-admin-edit permission assignments

Monitoring Recommendations

• Enable verbose logging for Solr's CoreAdmin API to capture full request parameters
• Deploy file integrity monitoring on Solr configuration directories to detect unauthorized configset access
• Implement network segmentation rules to restrict Solr server outbound connections, particularly SMB traffic
• Establish baseline metrics for core creation frequency and alert on deviations

How to Mitigate CVE-2026-22444

Immediate Actions Required

• Upgrade Apache Solr to version 9.10.1 or later, which contains fixes for this vulnerability
• Enable Solr's RuleBasedAuthorizationPlugin if currently disabled
• Review and restrict core-admin-edit permissions to trusted administrator accounts only
• Audit existing Solr cores for any that may have been created using unexpected configsets

Patch Information

Apache has released Apache Solr version 9.10.1 which contains the security fix for this vulnerability. Organizations should prioritize upgrading affected Solr deployments. Additional details are available in the Apache Mailing List Discussion and Openwall OSS-Security Update.

Workarounds

• Enable and properly configure RuleBasedAuthorizationPlugin to restrict "create core" API access to trusted administrators only
• Remove the core-admin-edit predefined permission from all non-admin user roles
• On Windows systems, disable or restrict UNC path support through group policy to prevent NTLM hash disclosure
• Implement network-level access controls to limit which hosts can reach the Solr admin API

# Example: Configure RuleBasedAuthorizationPlugin in security.json
# Place this configuration in your Solr security.json file
# Ensure only admin users have core-admin-edit permission
# {
#   "authorization": {
#     "class": "solr.RuleBasedAuthorizationPlugin",
#     "permissions": [
#       {"name": "core-admin-edit", "role": "admin"}
#     ]
#   }
# }