CVE-2026-22022
Apache Solr: some predefined permission rules in the RuleBasedAuthorizationPlugin can be bypassed
Technology
Apache Solr
CVSS Score
8.2 / 10.0
Affected Versions
5.3.0 to 9.10.0
Upstream Fix
9.10.1
Published
January 21, 2026
OSSeva Coverage
Fixed upstream
Description
Insufficiently strict input validation in Solr's RuleBasedAuthorizationPlugin lets clients reach APIs guarded by the config-read, config-edit, schema-read, metrics-read or security-read predefined permissions without authorization. It applies when the plugin defines multiple roles, uses one of those predefined permissions, does not define the "all" permission, and clients can send unfiltered requests to Solr. Rated moderate by the Solr PMC. Defining the "all" permission for a privileged role mitigates it. Fixed in 9.10.1.
Is your Apache Solr deployment affected?
If you're running 5.3.0 to 9.10.0, you need this patch. Book a discovery call to get covered.
View Apache Solr coverage →Get a quote
Running Apache Solr 5.3.0 to 9.10.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?