CVE-2026-22444: 
Java vulnerability analysis and mitigation

CVE-2026-22444 is an improper input validation vulnerability in the Apache Solr "create core" API affecting versions 8.6 through 9.10.0. The flaw allows Solr to check the existence of and attempt to read file-system paths that should be restricted by the allowPaths security setting, potentially enabling unauthorized configset access and, on Windows systems with UNC path support, NTLM hash disclosure. It was publicly disclosed on January 20–21, 2026, and is tracked upstream as SOLR-18058. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), requiring low privileges and no user interaction (oss-security, Feedly).

The root cause is insufficient input validation (CWE-20) on API parameters passed to the "create core" endpoint in Apache Solr's standalone mode. When crafted parameters are submitted, Solr performs file-system existence checks and read attempts on paths outside the directories permitted by the allowPaths configuration directive, effectively bypassing this security boundary. On Windows hosts where UNC paths are permitted, the server can be coerced into initiating an SMB connection to an attacker-controlled host, leaking the NTLM credentials of the Solr service account. Exploitation requires three concurrent conditions: Solr running in standalone mode, allowPath restrictions configured, and the "create core" API accessible to low-trust users (either because RuleBasedAuthorizationPlugin is disabled or the core-admin-edit permission is granted to non-admin roles). A public proof-of-concept is available on GitHub (oss-security, GitHub PoC).

Successful exploitation allows a low-privileged network attacker to read sensitive files accessible to the Solr process outside the intended allowPaths boundary, and to load unexpected configsets that could alter search behavior or expose indexed data. On Windows deployments with UNC paths enabled, the vulnerability additionally causes disclosure of NTLM user hashes for the Solr service account, which can be cracked offline or relayed for lateral movement. Availability is not directly impacted, but confidentiality is highly affected and integrity is partially affected through unauthorized configset creation (oss-security, Feedly).

1. Reconnaissance: Identify internet-facing Apache Solr instances running in standalone mode (versions 8.6–9.10.0) using Shodan, Censys, or similar tools by searching for the Solr admin UI or API endpoints.
2. Verify preconditions: Confirm that the target has allowPath restrictions configured and that the "create core" API (/solr/admin/cores?action=CREATE) is accessible without admin-level authorization.
3. Craft malicious API request: Submit a crafted HTTP GET or POST request to the create core API with manipulated parameters (e.g., instanceDir, dataDir, or configSet) pointing to file-system paths outside the allowed directories.
4. Bypass allowPaths: The insufficient input validation causes Solr to resolve and attempt to read the specified path, bypassing the allowPaths restriction and potentially loading a configset from an unintended location.
5. NTLM hash capture (Windows only): On Windows targets with UNC paths enabled, supply a UNC path (e.g., \\attacker-ip\share) as a parameter value. Solr will initiate an SMB authentication attempt to the attacker's server, disclosing the NTLM hash of the Solr service account, which can be captured using tools like Responder.
6. Post-exploitation: Use captured NTLM hashes for offline cracking or Pass-the-Hash attacks for lateral movement; or leverage unauthorized configset access to manipulate Solr's search behavior or extract indexed sensitive data (oss-security, GitHub PoC).

• Network: Unexpected outbound SMB (TCP 445) connections from the Solr server to external or unknown IP addresses (indicative of UNC path coercion / NTLM hash capture attempts); unusual HTTP requests to /solr/admin/cores?action=CREATE with non-standard instanceDir, dataDir, or configSet parameter values containing path traversal sequences or UNC paths.
• Logs: Solr access logs showing CREATE core API calls from non-administrative users or unexpected source IPs; Solr error logs referencing file-system access attempts to paths outside configured allowPaths directories; Windows Security Event Log entries (Event ID 4624/4625) showing NTLM authentication attempts from the Solr service account to external hosts.
• File System: Unexpected new Solr core directories created outside the standard data directory; unfamiliar configset directories appearing in the Solr installation path.
• Process: Solr JVM process initiating network connections to SMB ports on non-internal hosts (Windows environments) (oss-security, Feedly).

Users should upgrade to Apache Solr 9.10.1 or later, which contains the fix for this issue (tracked as SOLR-18058). As an immediate workaround, enable Solr's RuleBasedAuthorizationPlugin (if not already active) and configure a permission list that restricts the core-admin-edit permission to trusted administrator roles only, preventing untrusted users from invoking the "create core" API. On Windows systems, disable UNC path support if it is not operationally required to eliminate the NTLM hash disclosure risk. IBM Operational Decision Manager users should apply the April 2026 security bulletin patch (oss-security, IBM Advisory).

The vulnerability was disclosed via the Apache security mailing list and oss-security by Jason Gerlowski on January 20, 2026, crediting Damon Toey as the finder. Security news outlet SecurityOnline.info covered the flaw alongside other Apache Solr issues under the headline "Search Engine Exposed: Apache Solr Flaws Leak Data, Bypass Auth." A technical blog post on cryptobivash.code.blog titled "Decoding the RuleBasedAuthorization Bypass CVE-2026-22444 in Apache Solr" provided community analysis shortly after disclosure. Social media activity on Bluesky noted the CVE publication, and the Secret CISO newsletter included it in its January 22, 2026 edition (oss-security, SecurityOnline).