{
  "id": 15713250,
  "title": "Apache Solr exposure: 810,266 fingerprint matches against 73,029 title matches",
  "url": "https://urgent.news/2026/10/20/apache-solr-exposure-810-266-fingerprint-matches-against-73-029-title",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T07:02:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/stark_zhuang_df5076f35c68/apache-solr-exposure-810266-fingerprint-matches-against-73029-title-matches-4mdf"
  },
  "original_language": "en",
  "account": "Apache Solr, a search platform, exposes an extensive administrative API alongside its query endpoints. This API allows for core administration, configuration upload, and in some configurations, remote streaming of data. When an instance of Solr is exposed, it presents both a data exposure and a code execution risk. Historically, Solr has had vulnerabilities that have been exploited in the wild, prompting operators to closely monitor its population.\n\nThree queries were conducted on ZoomEye on September 26, 2026 (UTC) using the Python SDK, with a sub_type of 'all' and a page size of one. The queries returned 810,266 title matches, 73,029 title matches, and 1,319,525 port matches. The port query, which returns 1.3 million matches, represents every service listening on port 8983, not specifically Solr installations. This suggests that the port query is less specific and should not be used as a sole indicator of Solr exposure.\n\nThe discrepancy between the title and fingerprint query results is notable, with the fingerprint count being eleven times larger. This is because Solr's administrative interface often lacks a distinct page title, especially when deployed behind a proxy or with a custom path. The application signature, however, recognizes the response structure produced by Solr, regardless of its presentation layer. Therefore, the fingerprint query serves as a more reliable measurement for Solr instances.\n\nTo mitigate risks associated with Solr exposure, operators should ensure that the administrative API is protected by authentication. The vendor's security documentation outlines available authentication and authorization plugins, making enabling one a baseline requirement rather than an enhancement. When Solr is used internally, the administrative endpoint should be placed on an internal network or behind a proxy enforcing access control, rather than sharing the same listener as the query interface. Additionally, operators should be aware of the version running on any measured instance, as the count of matches does not provide this information.\n\nProtecting the query interface against unauthorized access is also crucial. Even if administration is secured, a search endpoint that retrieves documents from an index built over sensitive sources can still pose a data disclosure risk. While the counts provided are point-in-time matches and do not indicate whether a matched instance is vulnerable to specific issues, they serve as a useful starting point for operators to identify potential exposures.",
  "summary": "Apache Solr exposure: 810,266 fingerprint matches against 73,029 title matches A search engine with an administrative API Solr is a search platform that exposes a substantial administrative API alongside its query endpoints. Core administration, configuration upload and in some configurations remote streaming of data are all reachable through that API, which means an exposed instance is a data…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}