CVE-2023-50290: Apache Solr Metrics API exposes host environment variables

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw leaks host secrets to any user with metrics-read, and EPSS is very high despite no KEV listing.

What it is

Apache Solr's Metrics API publishes all unprotected environment variables for each Solr instance, and the default hide list is built for Java system properties rather than environment variables. Because environment variables are host-wide and cannot be strictly scoped in Solr, secrets set at the host level can leak. This affects Solr 9.0.0 before 9.3.0.

Impact

An attacker with the metrics-read permission can read environment variables from the Solr host, potentially obtaining credentials, tokens or other secrets that enable further access.

Attack surface

Reached over the network through the Solr Metrics API, which requires the metrics-read permission; no user interaction is needed. Solr Clouds with authorization configured are only exposed to users holding that permission.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is high at roughly 0.68 probability (99th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Apache Solr to 9.3.0 or later, where environment variables are no longer published via the Metrics API.
• Restrict the metrics-read permission to the smallest possible set of trusted users and service accounts.
• Avoid placing secrets in host-level environment variables for Solr hosts; use per-process Java system properties or a secrets manager instead.
• Review and tighten the environment variable hide list if staying on an affected version.
• Audit who holds metrics-read and rotate any secrets that may have been exposed.

Detection

• Monitor Metrics API requests, especially to endpoints returning environment data, and alert on access by unexpected users or sources.
• Review Solr audit logs for metrics-read usage outside normal monitoring accounts.
• Scan Solr hosts for secrets stored in environment variables that would be exposed by this flaw.
• Watch for outbound connections or authentication attempts using credentials that could have leaked from Solr hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.