{"id":"CVE-2026-22444","summary":"Apache Solr: Insufficient file-access checking in standalone core-creation requests","details":"The \"create core\" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's  \"allowPaths\" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element .  These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem.  On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM \"user\" hashes. \n\nSolr deployments are subject to this vulnerability if they meet the following criteria:\n  *  Solr is running in its \"standalone\" mode.\n  *  Solr's \"allowPath\" setting is being used to restrict file access to certain directories.\n  *  Solr's \"create core\" API is exposed and accessible to untrusted users.  This can happen if Solr's  RuleBasedAuthorizationPlugin https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html  is disabled, or if it is enabled but the \"core-admin-edit\" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles.\n\nUsers can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores.  Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue.","aliases":["BIT-solr-2026-22444","GHSA-vc2w-4v3p-2mqw"],"modified":"2026-07-17T21:17:09.944027796Z","published":"2026-01-21T13:40:24.979Z","database_specific":{"cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22444.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"8.6"},{"last_affected":"9.10.0"}]},{"extracted_events":[{"introduced":"8.6"},{"fixed":"9.10.0"}],"source":"DESCRIPTION"}],"cna_assigner":"apache"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/01/20/5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22444.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/qkrb9dd4xrlqmmq73lrhkbfkttto2d1m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22444"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/solr","events":[{"introduced":"a9c5fb0da2dfc8c7375622c80dbf1a0cc26f44dc"},{"fixed":"c135e6335c7158fa26e96b0dc386f825255b47c0"}],"database_specific":{"extracted_events":[{"introduced":"8.6.0"},{"fixed":"9.10.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22444.json","vanir_signatures_modified":"2026-07-16T08:45:19Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["120351066446823816478796849004261422818","240096633457384710817831422835243155014","38407301923442668321566180519037740960","70887022760867387724935329588019576026","179764876838053657294407215034930486763","147010765790336563100542354187234898306","235195966746351378923427209707493487952","252738467133413507932928310686382280740","125498264179157591138267264563231953791","274556390625100524067649328904052755074","105724591352013391946343718295551276907"],"threshold":0.9},"id":"CVE-2026-22444-080149c3","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/SchemaHandler.java"}},{"target":{"file":"solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPluginBase.java"},"deprecated":false,"digest":{"line_hashes":["213816450732649115831861879533981273321","163193992802835521350643549808705414096","279118738397569944925485559297762383710","292160663259868763816534406745559155717","292886144000345370672917144520777225418","212218239995638886601205653734497122566","115623506190209366829014816956538412072","224564576758229972759187356840065482736","217331465601713269584028593832134385524","89782819908593946504040573337181962855","42860695080087217257410980168474507559","107838308683085978204004722138780091915","79058199511659309388233803781513898946","111432781214598984776824816440695734017"],"threshold":0.9},"id":"CVE-2026-22444-0c32e4e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/SolrConfigHandler.java","function":"handleRequestBody"},"deprecated":false,"digest":{"function_hash":"32925405534186697611758232727948623468","length":823},"id":"CVE-2026-22444-0d1b1c1f"},{"signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/admin/ZookeeperInfoHandler.java"},"deprecated":false,"digest":{"line_hashes":["314801486394218332716187729587448876463","297668234085621649269638207073739227034","26281571418882802927218490246317570896","205376203250744969032773389049148311459","283448128921637611284629852895021185453","328300450744435674427303806605054338610","126769086198631888730044546654791673343","151361157194820677335377167858870518441","196983403002202730118792808163427749455","270709262109556431487133335638324708502","231172665077771227225530430677086623289","143827515772777178233896868672522835173","39774938605117814597467235289023746573","123918541420775112442862666052329074535","271722009058798431788998140996009881917"],"threshold":0.9},"id":"CVE-2026-22444-1807e42d","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/admin/InfoHandler.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["184580313771887693335343806361893098191","114232322428923849323544561933002927043","30584587213142902972153208626010345669","43693651672511506419582617180681485734"]},"id":"CVE-2026-22444-2383ef3c"},{"digest":{"function_hash":"309815762935292469119908422789899307526","length":218},"id":"CVE-2026-22444-24965513","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/SchemaHandler.java","function":"getPermissionName"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPluginBase.java","function":"predefinedPermissionAppliesToRequest"},"deprecated":false,"digest":{"function_hash":"198955079849774671245214682800515656826","length":763},"id":"CVE-2026-22444-3f238353"},{"digest":{"function_hash":"192251288855912286863646833069882127951","length":3364},"id":"CVE-2026-22444-41a805d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/api/V2HttpCall.java","function":"init"},"deprecated":false},{"id":"CVE-2026-22444-52fb444d","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java","function":"HttpSolrCall"},"deprecated":false,"digest":{"function_hash":"243056432508320266151977870548656376306","length":491}},{"target":{"function":"getPermissionName","file":"solr/core/src/java/org/apache/solr/handler/admin/ConfigSetsHandler.java"},"deprecated":false,"digest":{"function_hash":"82786319854879818071137322427327792859","length":372},"id":"CVE-2026-22444-5b865d58","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/api/V2HttpCall.java"},"deprecated":false,"digest":{"line_hashes":["318557942750693441999088965693350408448","89960675082884901922971492094076631557","262092700101760725112401888166373233301","334782200771506371045421436203045874610","131546795612910344415808924453403828385","221912604077071235305348779528085248181","89567214609396714330781788893967812849","284614647882360805072877494404776484119"],"threshold":0.9},"id":"CVE-2026-22444-6be6609b"},{"deprecated":false,"digest":{"line_hashes":["58079458214666953562059678735478141157","240096633457384710817831422835243155014","38407301923442668321566180519037740960","70887022760867387724935329588019576026","179764876838053657294407215034930486763","260152357607745243888842854418287848754","86961638886321900848155678858025933347","252738467133413507932928310686382280740","302947476867847430838349182753615611583"],"threshold":0.9},"id":"CVE-2026-22444-7696d9b0","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/SolrConfigHandler.java"}},{"deprecated":false,"digest":{"function_hash":"187430033858308537579957157295996246614","length":969},"id":"CVE-2026-22444-948e0f90","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/SchemaHandler.java","function":"handleRequestBody"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/admin/ConfigSetsHandler.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["268011071793190307035707587271849564271","220884027888050459794073188008898298494","67285741456772442012070940876174401461"]},"id":"CVE-2026-22444-9673dd58"},{"target":{"file":"solr/core/src/java/org/apache/solr/handler/admin/SecurityConfHandler.java","function":"getPermissionName"},"deprecated":false,"digest":{"function_hash":"293080062925405529498466231476761499269","length":193},"id":"CVE-2026-22444-9b2dfa87","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0"},{"target":{"file":"solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java"},"deprecated":false,"digest":{"line_hashes":["150813839389802449390950779385082769168","157794120277178151238190850924822186718","314736040055257015328658767592783323746","74116944502192974550916330399986272055","100520713306865751721762720970362402368","118794164569753631862788791376220138110","221156805908894640553280895674511800568","143789150691660144250348740337673456259","46293612379576255285533091099265037937","108049300500548630487952472209689740132","106565269668895078264801588273834550237","204853156103783033210753635899650237082","50185046149780929867426153052567393208","253377974398886683499594306020509175379","227591688282585696639089661864366244677","206431445711209699518597590513933735912","50185046149780929867426153052567393208","91721883678795952664516638675545785829","137957176553714511067886981903703329252","4685551427119535434065476578473383278","137764885550340150603133934097966614117","270858092755672118626541746230037820837","24047165802911169747952491494324947778","245056690808061670376731011290420441844","198225703671653806079590215890600246031","103515158874399903575503905129021947114","98286586969809525074700928560639018412","210068617637129298119821977885415841024","195650629001091535143767240297304192978"],"threshold":0.9},"id":"CVE-2026-22444-ad906785","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0"},{"signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/admin/SecurityConfHandler.java"},"deprecated":false,"digest":{"line_hashes":["268561176960722250138687528000324643692","67774571265588972589539497833261280251","189415833787220364941020379284641578567","194557142506412884006270997149839987165","84419659714445746731018964436727399059","162864881589519443502030191436134728087","252738467133413507932928310686382280740","111106639122235668039694155904913124616"],"threshold":0.9},"id":"CVE-2026-22444-ae980129","signature_type":"Line"},{"deprecated":false,"digest":{"length":289,"function_hash":"213238151330680154814911143903409297264"},"id":"CVE-2026-22444-d82e9e6e","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/admin/CollectionsHandler.java","function":"getPermissionName"}},{"deprecated":false,"digest":{"function_hash":"66091817643857218543813963995517282094","length":189},"id":"CVE-2026-22444-d97ed861","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/SolrConfigHandler.java","function":"getPermissionName"}},{"digest":{"length":2278,"function_hash":"111282808569295236401628538870253350022"},"id":"CVE-2026-22444-df9c6529","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java","function":"init"},"deprecated":false},{"source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/admin/CollectionsHandler.java"},"deprecated":false,"digest":{"line_hashes":["226306296248802359310220247995995277013","121496908389995506677154849858255989362","107621676927053957725034464286008436807","228164321359792569823207322297444593680"],"threshold":0.9},"id":"CVE-2026-22444-ec2023d6","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"120437475613747371534359341551457016583","length":317},"id":"CVE-2026-22444-fd16b4b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/admin/ZookeeperInfoHandler.java","function":"getPermissionName"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0","target":{"file":"solr/core/src/java/org/apache/solr/handler/admin/InfoHandler.java","function":"getPermissionName"},"deprecated":false,"digest":{"length":280,"function_hash":"180201855755994066701040275748131575002"},"id":"CVE-2026-22444-ffb0da62"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"}]}