Search Engine Exposed: Apache Solr Flaws Leak Data & Bypass Auth

Executive summary: Apache Solr versions from 5.3 through 9.10.0 are affected by two moderate vulnerabilities: CVE-2026-22444 (insufficient input validation in the create core API allowing unauthorized filesystem reads and potential NTLM hash exposure on Windows when UNC paths are permitted) and CVE-2026-22022 (an input-validation flaw in RuleBasedAuthorizationPlugin that can permit API access bypass when permission rules are misconfigured). Apache has released Solr 9.10.1 to address both issues; administrators should patch immediately or apply recommended mitigations such as enabling and strictly configuring the RuleBasedAuthorizationPlugin and explicitly assigning the "all" permission to an administrative role.