Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ayj5-uq2f-j7g5
Vulnerability ID VCID-ayj5-uq2f-j7g5
Aliases CVE-2026-22022
GHSA-qr3p-2xj2-q7hq
Summary Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input validation in those components.  Only deployments that meet all of the following criteria are impacted by this vulnerability: * Use of Solr's "RuleBasedAuthorizationPlugin" * A RuleBasedAuthorizationPlugin config (see security.json) that specifies multiple "roles" * A RuleBasedAuthorizationPlugin permission list (see security.json) that uses one or more of the following pre-defined permission rules: "config-read", "config-edit", "schema-read", "metrics-read", or "security-read". * A RuleBasedAuthorizationPlugin permission list that doesn't define the "all" pre-defined permission * A networking setup that allows clients to make unfiltered network requests to Solr. (i.e. user-submitted HTTP/HTTPS requests reach Solr as-is, unmodified or restricted by any intervening proxy or gateway) Users can mitigate this vulnerability by ensuring that their RuleBasedAuthorizationPlugin configuration specifies the "all" pre-defined permission and associates the permission with an "admin" or other privileged role.  Users can also upgrade to a Solr version outside of the impacted range, such as the recently released Solr 9.10.1.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-285 Improper Authorization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22022.json
epss 0.00236 https://api.first.org/data/v1/epss?cve=CVE-2026-22022
epss 0.00236 https://api.first.org/data/v1/epss?cve=CVE-2026-22022
epss 0.00236 https://api.first.org/data/v1/epss?cve=CVE-2026-22022
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qr3p-2xj2-q7hq
cvssv3.1 8.2 https://github.com/apache/solr
generic_textual HIGH https://github.com/apache/solr
cvssv3.1 8.2 https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0
generic_textual HIGH https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0
cvssv3.1 8.2 https://issues.apache.org/jira/browse/SOLR-18054
generic_textual HIGH https://issues.apache.org/jira/browse/SOLR-18054
cvssv3.1 8.2 https://lists.apache.org/thread/d59hqbgo7p62myq7mgfpz7or8n1j7wbn
generic_textual HIGH https://lists.apache.org/thread/d59hqbgo7p62myq7mgfpz7or8n1j7wbn
ssvc Track https://lists.apache.org/thread/d59hqbgo7p62myq7mgfpz7or8n1j7wbn
cvssv3.1 8.2 https://nvd.nist.gov/vuln/detail/CVE-2026-22022
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-22022
cvssv3.1 8.2 http://www.openwall.com/lists/oss-security/2026/01/20/4
generic_textual HIGH http://www.openwall.com/lists/oss-security/2026/01/20/4
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22022.json
https://api.first.org/data/v1/epss?cve=CVE-2026-22022
https://github.com/apache/solr
https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0
https://issues.apache.org/jira/browse/SOLR-18054
http://www.openwall.com/lists/oss-security/2026/01/20/4
2431603 https://bugzilla.redhat.com/show_bug.cgi?id=2431603
CVE-2026-22022 https://nvd.nist.gov/vuln/detail/CVE-2026-22022
d59hqbgo7p62myq7mgfpz7or8n1j7wbn https://lists.apache.org/thread/d59hqbgo7p62myq7mgfpz7or8n1j7wbn
GHSA-qr3p-2xj2-q7hq https://github.com/advisories/GHSA-qr3p-2xj2-q7hq
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22022.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://github.com/apache/solr
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://github.com/apache/solr/commit/c135e6335c7158fa26e96b0dc386f825255b47c0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://issues.apache.org/jira/browse/SOLR-18054
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://lists.apache.org/thread/d59hqbgo7p62myq7mgfpz7or8n1j7wbn
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-21T15:34:12Z/ Found at https://lists.apache.org/thread/d59hqbgo7p62myq7mgfpz7or8n1j7wbn
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-22022
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2026/01/20/4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.46808
EPSS Score 0.00236
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:52:50.411600+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/22xxx/CVE-2026-22022.json 38.6.0