CVE-2021-29943: Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-13 · updated 2026-06-17
Weakness: CWE-863

Description

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.

Affected products

Apache Software Foundation Apache Solr: before 8.8.2 — fixed in 8.8.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Solr 8.8.2. Check the vendor advisory for mitigations.

References

https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E
https://security.netapp.com/advisory/ntap-20210604-0009/
https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E
https://security.netapp.com/advisory/ntap-20210604-0009/

Get alerted when CVE-2021-29943 or the next vulnerability affects your stack