This vulnerability (CVE-2026-44825) in Apache Solr arises from hardcoded credentials embedded in the Basic Authentication setup tool used during bootstrap. The affected versions (9.4.0 through 9.10.1 and 10.0.0) install default template users (superadmin, admin, search, index) with known passwords alongside user accounts, enabling remote attackers to authenticate with these credentials and gain full administrative control over the Solr cluster. The issue does not affect clusters that did not use the BasicAuth bootstrap or where template user passwords were changed post-bootstrap. The vendor plans to fix this in upcoming versions 9.11.0 and 10.1.0.

Successful exploitation allows a remote attacker to gain full administrative access to the Apache Solr cluster, compromising confidentiality, integrity, and availability. This includes the ability to control the cluster, modify data, and disrupt services. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction.

As no official patch or fix is currently available, immediate mitigation involves deleting the template users (superadmin, admin, search, index) from the security.json file or changing their passwords to strong, unique values. Clusters that did not use the BasicAuth bootstrap or have already assigned strong passwords to template users are not vulnerable. Upgrading to versions 9.11.0 or 10.1.0 once released will fully resolve the issue. Monitor the Apache Software Foundation advisories for the official release and patch availability.