CVE-2026-44825¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr 9.4.0 through 9.10.1 and 10.0.0 allow a remote attacker to gain full administrative access to a cluster via publicly known default credentials that are installed silently alongside the user-specified account. Clusters where bin/solr auth enable was not used to bootstrap BasicAuth are not affected.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
WSO2 Identity Server bundles Apache Solr to support registry content indexing and search. The version present is within the affected range, but the precondition the advisory describes cannot occur in this product:
The setup tool that installs the credentials is not shipped. The defect arises only when bin/solr auth enable writes template users (superadmin, admin, search, index) with publicly known passwords into security.json. The product ships no bin/solr launcher, no security.json anywhere in the distribution, and no Solr authentication plugin configuration. AuthTool, SolrCLI, BasicAuthPlugin and Sha256AuthenticationProvider are referenced by no component outside the Solr bundle itself.
Solr exposes no network endpoint. Solr runs embedded, driven through the EmbeddedSolrServer API by the registry indexing component using direct in-process Java method calls. JettySolrRunner and SolrDispatchFilter, which back the standalone HTTP server, are referenced by nothing in the distribution. Registry indexing is additionally disabled by default in the shipped repository/conf/registry.xml.
Since no default credentials are ever written and no Solr administrative endpoint is exposed, there is no path by which a remote attacker could use this defect.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.