Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Apache Solr's Streaming Expressions, in the solr-solrj-streaming and solr-solrj packages, are vulnerable in versions 6.0.0 through 8.11.2 and 9.0.0 before 9.4.1. A user with read permission on the "/streaming" handler can supply a "zkHost" value pointing to a server they control, which can receive the ZooKeeper credentials and ACLs of the original SolrCloud and expose sensitive information. Upgrade to solr-solrj-streaming or solr-solrj 8.11.3 or 9.4.1, which only send credentials to zkHost values with the same server address.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.016, the 75th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:18 UTC First seen by agentprime
- 31 Oct 2026, 14:18 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-xrj7-x7gp-wwqr
- OSV: GHSA-xrj7-x7gp-wwqr
- nvd.nist.gov/vuln/detail/CVE-2023-50298
- github.com/apache/lucene-solr/commit/61c956c426b2cfb85ccef55d1afca4335eacd269
- github.com/apache/solr/commit/e2bf1f434aad873fbb24c21d46ac00e888806d98
- github.com/apache/solr
- issues.apache.org/jira/browse/SOLR-17098
- solr.apache.org/security.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions
- www.openwall.com/lists/oss-security/2024/02/09/2
- www.openwall.com/lists/oss-security/2024/02/09/3