Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input validation in those components. Only deployments that meet all of the following criteria are impacted by this vulnerability: * Use of Solr's "RuleBasedAuthorizationPlugin" * A RuleBasedAuthorizationPlugin config (see security.json) that specifies multiple "roles" * A RuleBasedAuthorizationPlugin permission list (see security.json) that uses one or more of the following pre-defined permission rules: "config-read", "config-edit", "schema-read", "metrics-read", or "security-read". * A RuleBasedAuthorizationPlugin permission list that doesn't define the "all" pre-defined permission * A networking setup that allows clients to make unfiltered network requests to Solr. (i.e. user-submitted HTTP/HTTPS requests reach Solr as-is, unmodified or restricted by any intervening proxy or gateway) Users can mitigate this vulnerability by ensuring that their RuleBasedAuthorizationPlugin configuration specifies the "all" pre-defined permission and associates the permission with an "admin" or other privileged role. Users can also upgrade to a Solr version outside of the impacted range, such as the recently released Solr 9.10.1.

Apache Solr versions 5.3.0 through 9.10.0 are affected by an authorization bypass vulnerability in the RuleBasedAuthorizationPlugin due to insufficient input validation. When multiple roles are configured, the "config-read", "config-edit", "schema-read", "metrics-read" or "security-read" predefined permissions are used and the "all" permission is not defined, clients sending requests directly to Solr may access some APIs without the required authorization.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's Rule Based Authorization Plugin are     vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input     validation in those components. Only deployments that meet all of the following criteria are impacted by     this vulnerability: * Use of Solr's RuleBasedAuthorizationPlugin * A RuleBasedAuthorizationPlugin config     (see security.json) that specifies multiple roles * A RuleBasedAuthorizationPlugin permission list (see     security.json) that uses one or more of the following pre-defined permission rules: config-read,     config-edit, schema-read, metrics-read, or security-read. * A RuleBasedAuthorizationPlugin     permission list that doesn't define the all pre-defined permission * A networking setup that allows     clients to make unfiltered network requests to Solr. (i.e. user-submitted HTTP/HTTPS requests reach Solr     as-is, unmodified or restricted by any intervening proxy or gateway) Users can mitigate this vulnerability     by ensuring that their RuleBasedAuthorizationPlugin configuration specifies the all pre-defined     permission and associates the permission with an admin or other privileged role. Users can also upgrade     to a Solr version outside of the impacted range, such as the recently released Solr 9.10.1.
    (CVE-2026-22022)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are
    vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input
    validation in those components. Only deployments that meet all of the following criteria are impacted by
    this vulnerability: * Use of Solr's "RuleBasedAuthorizationPlugin" * A RuleBasedAuthorizationPlugin config
    (see security.json) that specifies multiple "roles" * A RuleBasedAuthorizationPlugin permission list (see
    security.json) that uses one or more of the following pre-defined permission rules: "config-read",
    "config-edit", "schema-read", "metrics-read", or "security-read". * A RuleBasedAuthorizationPlugin
    permission list that doesn't define the "all" pre-defined permission * A networking setup that allows
    clients to make unfiltered network requests to Solr. (i.e. user-submitted HTTP/HTTPS requests reach Solr
    as-is, unmodified or restricted by any intervening proxy or gateway) Users can mitigate this vulnerability
    by ensuring that their RuleBasedAuthorizationPlugin configuration specifies the "all" pre-defined
    permission and associates the permission with an "admin" or other privileged role. Users can also upgrade
    to a Solr version outside of the impacted range, such as the recently released Solr 9.10.1.
    (CVE-2026-22022)

ID	Name	Product	Family	Type	Severity
115559	Apache Solr 5.3.0 < 9.10.1 RuleBasedAuthorizationPlugin Authorization Bypass	Web App Scanning	Component Vulnerability	Version Based	high
297709	Linux Distros Unpatched Vulnerability : CVE-2026-22022	Nessus	Misc.	Local	high
436883	SCA: security update for org.apache.solr:solr-core (GHSA-qr3p-2xj2-q7hq)	Tenable Cloud Security	SCA Checks	Local	high
436883	SCA: security update for org.apache.solr:solr-core (GHSA-qr3p-2xj2-q7hq)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-22022

high

Tenable Plugins

high

high

high

high