CVE

CVE-2021-27905

9.8

CVSS

Description

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Attack Vector

Privileges Req.

User Interaction

apache solr

Updated Oct 24, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~15 seconds

CVE-2021-27905 Scanner

Detects 'Server-Side-Request-Forgery (SSRF)' vulnerability in Apache Solr affects v. before 8.8.2.

Used 2.9k times · 3.4k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: apache solr

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →