- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 7 days
The published timeline is PMC triage inside seven days and investigation inside ninety
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://solr.apache.org
Products and areas 11
- Authentication and authorization plugins in full, covering the rule-based authorization plugin, JWT and Kerberos handling, and how a principal is resolved into permissions
- Config-set handling, solrconfig.xml and schema processing, and any place a configuration document reaches a class loader
- Query parsing across every parser Solr exposes, including function queries, the streaming expression language and the SQL interface
- Replication, backup and restore, which move index files and credentials between machines
- Scripting and plugin loading, including anything that resolves a class name or a URL from configuration
- SolrCloud and its ZooKeeper interaction: cluster state, leader election, the collections API and inter-node requests that carry a trusted identity
- The Admin UI and the administrative endpoints behind it, including core creation, core reload, replication and the config-set upload path
- The bin/solr command-line tooling, including the auth setup path that writes credentials to disk
- The data import and extraction paths that pull documents from remote sources and hand them to parsers
- The full HTTP API surface: query handlers, update handlers, the schema and config APIs, and every request handler a core exposes
- The published reporting process accepts any undisclosed security issue in Solr privately, with the PMC triaging it and the ASF process carrying it to a CVE. THREAT_MODEL.md narrows what counts as a finding rather than which components are in scope, so the whole server is fair ground
Out of scope (6)
- Apache Lucene itself, which has its own report path even though Solr is built on it
- Deployment choices an operator made, such as running Solr on an open port with no authentication plugin configured
- Findings the threat model already answers: unauthenticated exposure of an instance an operator put on a public network, SSRF the operator's network controls are expected to bound, and features that ship disabled
- Reports filed publicly on Jira or GitHub, which put the issue outside the coordinated process
- Third-party Solr plugins and connectors that are not part of the Solr distribution
- Upstream libraries Solr embeds, including Apache Tika. CVE-2025-66516 shows the pattern, a Tika XXE reached through the extraction module and attributed upstream
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report privately to the address on the policy page .
-
Read THREAT_MODEL.md in the repository before you write the report.
-
Send the report in plaintext.
-
Do not open a public Jira issue or a GitHub issue for a security bug.
-
Name the Solr version range you tested and whether authentication and authorization plugins were configured.
Not accepted
-
unauthenticated exposure of an instance an operator put on a public network
-
SSRF the operator's network controls are expected to bound
-
features that ship disabled
-
Upstream libraries Solr embeds, including Apache Tika
-
Apache Lucene itself
-
Deployment choices an operator made
-
Third-party Solr plugins and connectors that are not part of the Solr distribution
-
Reports filed publicly on Jira or GitHub
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-97355 | Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-97356 | External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter o | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-82960 | Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because th | High 8.8 | 5 Nov 2026 |
| CVE-2026-83538 | Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no p | Medium 5.3 | 5 Nov 2026 |
| CVE-2026-83542 | Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its | Critical 9.8 | 5 Nov 2026 |
| CVE-2026-84183 | Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CR | High 8.8 | 5 Nov 2026 |
| CVE-2026-84728 | Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostn | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-85627 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no | High 8.8 | 5 Nov 2026 |
| CVE-2026-92887 | Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of th | High 7.3 | 5 Nov 2026 |
| CVE-2026-82904 | Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by mu | High 7.5 | 5 Nov 2026 |
| CVE-2026-82907 | Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the | Critical 9.8 | 5 Nov 2026 |
| CVE-2026-82910 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute | High 8.8 | 5 Nov 2026 |
| CVE-2026-82912 | Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the | High 8.8 | 5 Nov 2026 |
| CVE-2026-82916 | Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassw | High 7.1 | 5 Nov 2026 |
| CVE-2026-82902 | Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supply | Medium 4.3 | 5 Nov 2026 |
| CVE-2026-114233 | Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShi | High 8.1 | 5 Nov 2026 |
| CVE-2026-114235 | Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114271 | Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take ownership of it, and thereby read its contents, via a request to the shopping list update endpoint that supplies the other part | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114272 | Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent request that combines a contentId they can view with the dataResourceId of other content. Users are recommend | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114277 | Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue. | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-109129 | Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via the updateOrderPaymentPreference service, by supplying an orderPaymentPreferenceId belonging to a differ | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-109837 | Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, via the createReturnItem service. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-109856 | Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, creat | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-109928 | Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure, or a man-in-the-middle on the mail transport) to authenticate as that user and obtain a full, unrestricted session, including administrative | High 7.4 | 5 Nov 2026 |
| CVE-2026-114229 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application. Users are recommended to upgrade | Medium 6.1 | 5 Nov 2026 |
| CVE-2026-59267 | A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.8 | 4 Nov 2026 |
| CVE-2026-90631 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOffice: through 4.1.16. Users are recommended to upgrade to version 4.1.17, which fixes | Low 3.3 | 4 Nov 2026 |
| CVE-2026-90632 | Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.5 | 4 Nov 2026 |
| CVE-2026-90634 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90624 | An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90626 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90627 | The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.5 | 4 Nov 2026 |
| CVE-2026-90628 | An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90629 | An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-59264 | The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.8 | 4 Nov 2026 |
| CVE-2026-59268 | An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-59263 | A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Low 1.9 | 4 Nov 2026 |
| CVE-2026-64618 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to vers | Critical 9.8 | 30 Oct 2026 |
| CVE-2026-65874 | This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existin | High 8.8 | 30 Oct 2026 |
| CVE-2026-95628 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer builds the command line of the external docling tool and appends to it the custom arguments supplied in the CamelDoclingCustomArguments header, a list of strings whose f | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-95629 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer runs the external docling tool in CLI mode, the default, and tells it where to write the converted document through the --output flag. When the CamelDoclingOutputFilePat | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-95663 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection | Medium 4.8 | 26 Oct 2026 |
| CVE-2026-95664 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-101259 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caught the resulting exception and sent its message back to the CoAP client as the payload of a 5.00 Intern | Medium 5.3 | 26 Oct 2026 |
| CVE-2026-111497 | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie | Critical 9.2 | 22 Oct 2026 |
| CVE-2026-88900 | Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an Objec | High 8.8 | 19 Oct 2026 |
| CVE-2026-85313 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that let | Medium 4.3 | 19 Oct 2026 |
| CVE-2026-85314 | Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered path: unmarshalling a multipart message mapped mail.smtp headers onto the Exchange w | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85315 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status description. Unlike the status cause, which stays local to the server, the description is transmitted to th | Medium 5.3 | 19 Oct 2026 |
| CVE-2026-85316 | Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with the string proxy, rather than by matching the path exactly. Any endpoint whose path merely begins with t | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85317 | Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a token actually authorises: the requested scope, the resource indicator, and the token endpoint the token w | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85254 | Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names are case insensitive. A caller could therefore defeat the suppression simply by va | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85257 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, the exception was described back to the SOAP client in the fault: CXF copies the message into the SOAP f | Medium 5.3 | 19 Oct 2026 |
| CVE-2026-85260 | Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log. It defaulted to true, so a deployment that did nothing logged protected health information out of the | Medium 5.5 | 19 Oct 2026 |
| CVE-2026-85296 | Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined to the request being processed. Where a deployment serves more than one trading partner, concurrent or | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85312 | Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer header filters block, and an external sender could | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85247 | Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on | Medium 5.9 | 19 Oct 2026 |
| CVE-2026-85249 | Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied. Document metadata is attacker-controlled content: the party that supplies the file chooses the metadata ke | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85250 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default documen | High 7.5 | 19 Oct 2026 |
| CVE-2026-85251 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequ | High 7.5 | 19 Oct 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 3 Last 12 months Authorization bypass 40 % Input validation 25 % Credential handling 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Solr is the enterprise search server behind a great many intranets and product catalogues, and it ships embedded inside commercial products whose operators do not think of themselves as running Solr. It holds an index of everything an organisation decided to make searchable, and it exposes an administrative API that creates cores and loads configuration. CVE-2026-44825 is the reference point: bin/solr auth enable wrote a hardcoded credential into the setup it had just secured. The Apache Software Foundation runs no bug bounty, so a report earns advisory credit and nothing more. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published reporting process accepts any undisclosed security issue in Solr privately, with the PMC triaging it and the ASF process carrying it to a CVE. THREAT_MODEL.md narrows what counts as a finding rather than which components are in scope, so the whole server is fair ground The full HTTP API surface: query handlers, update handlers, the schema and config APIs, and every request handler a core exposes The Admin UI and the administrative endpoints behind it, including core creation, core reload, replication and the config-set upload path Authentication and authorization plugins in full, covering the rule-based authorization plugin, JWT and Kerberos handling, and how a principal is resolved into permissions SolrCloud and its ZooKeeper interaction: cluster state, leader election, the collections API and inter-node requests that carry a trusted identity Query parsing across every parser Solr exposes, including function queries, the streaming expression language and the SQL interface Config-set handling, solrconfig.xml and schema processing, and any place a configuration document reaches a class loader The data import and extraction paths that pull documents from remote sources and hand them to parsers Scripting and plugin loading, including anything that resolves a class name or a URL from configuration Replication, backup and restore, which move index files and credentials between machines The bin/solr command-line tooling, including the auth setup path that writes credentials to disk Out of scope Findings the threat model already answers: unauthenticated exposure of an instance an operator put on a public network, SSRF the operator's network controls are expected to bound, and features that ship disabled Upstream libraries Solr embeds, including Apache Tika. CVE-2025-66516 shows the pattern, a Tika XXE reached through the extraction module and attributed upstream Apache Lucene itself, which has its own report path even though Solr is built on it Deployment choices an operator made, such as running Solr on an open port with no authentication plugin configured Third-party Solr plugins and connectors that are not part of the Solr distribution Reports filed publicly on Jira or GitHub, which put the issue outside the coordinated process Most-valued findings Authorization bypass in the permission model: any path where a principal reaches a collection, a handler or an admin action the rules did not grant. CVE-2026-22022 sat in the rule-based authorization plugin's JWT handling across every release from 5.3.0 to 9.10.0 Input validation on the administrative APIs, particularly core and collection creation, where a crafted parameter reaches the filesystem or the class loader. CVE-2026-22444 landed exactly there Credentials written, logged or defaulted by the tooling. CVE-2026-44825 put a hardcoded credential into the output of the command that enables authentication Anything that turns a query into remote code execution, through a function query, a streaming expression, a config-set upload or a class name resolved from configuration Cross-collection reads on a multi-tenant SolrCloud cluster, where one tenant's query returns another tenant's documents Inter-node request handling that treats a request from the cluster as pre-authenticated, since reaching that path from outside collapses the whole authorization model Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] . The Solr PMC is also reachable at [email protected] and the project alias is [email protected] Read THREAT_MODEL.md in the repository before you write the report. Triagers are told to read it before handling a tool, fuzzer or AI finding, and it rules out several classes on sight Send the report in plaintext. The published workflow asks for it and encrypted or attachment-heavy mail slows triage The published timeline is PMC triage inside seven days and investigation inside ninety, ending in coordinated disclosure with a CVE and an oss-security announcement Do not open a public Jira issue or a GitHub issue for a security bug. The process stays private until the announcement Name the Solr version range you tested and whether authentication and authorization plugins were configured. Solr's default posture and a hardened deployment behave differently, and the difference decides severity Nothing is paid at any severity. Neither SECURITY.md nor either Solr security page carries reward language Disclosure Coordinated through the ASF security team and the Solr project management committee, ending in a CVE, an advisory on solr.apache.org and an announcement to oss-security once a fixed release is available. The workflow states triage inside seven days and investigation inside ninety, so plan on an embargo measured against the next security release rather than a date you choose. Hold detail until the announcement is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability