Detections
Analytics

Chainguard: multiple solr-9 packages: security update to 9.11.0-r0

critical Tenable Cloud Security Plugin ID 474013

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr
 versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to
 the cluster via publicly known default credentials installed silently alongside the user-specified
 account. As an immediate workaround without upgrading, delete the template users (superadmin, admin,
 search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0
 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue. Not affected: *
 Clusters where bin/solr auth enable was not used to bootstrap BasicAuth * Clusters where template users
 have been assigned strong passwords after bootstrap (CVE-2026-44825)

Solution

Update the solr-9 library and its related packages to version 9.11.0-r0 or later.

Plugin Details

Severity: Critical

ID: 474013

Version: Revision 1.1

Type: Local

Published: 10/9/2026

Updated: 10/9/2026

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 99.03

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-44825

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 6/1/2026

Exploitable With

Core Impact

Reference Information

CVE: CVE-2026-44825