CVE-2026-45083 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-45083 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-45083 is a critical unauthenticated remote attack against maven io.goobi.viewer:viewer-core that exposed the Goobi viewer REST endpoint POST /api/v1/index/stream to arbitrary Solr streaming expressions. In practical terms, a network attacker could read the full Solr index and, in many default Solr deployments, also modify or delete indexed records. The endpoint has been removed in the fixed release, but if you run a vulnerable version, treat this as an urgent production incident.

KEV: No. Exploited in the wild: No known reports at publication time. That does not reduce the urgency: the flaw is unauthenticated, high-impact, and easy to abuse if exposed.

Immediate Action

  • Block the endpoint now at your reverse proxy or Tomcat layer if you cannot patch immediately.
  • Upgrade to the fixed release that includes commit 326980f24c or later. If your package/version mapping is unclear, use the vendor advisory and release notes: vendor advisory.
  • Restrict Solr access so the application cannot be reached directly from untrusted networks.
  • Assume index exposure if the endpoint was reachable: review for data leakage, metadata tampering, or deleted documents.
  • Re-index if needed after confirming integrity, especially if you see unexpected field changes or missing documents.
  • Rotate credentials/secrets if your Solr or viewer stack shares admin tokens, service accounts, or internal API keys.

Affected Versions

  • io.goobi.viewer:viewer-core versions containing POST /api/v1/index/stream are vulnerable.
  • package@<= TODO_VULNERABLE_VERSION vulnerable; upgrade to TODO_FIXED_VERSION+.
  • Safe versions: releases that include the removal in 326980f24c or later.

Resolution Guide

Best fix: upgrade to the patched release as soon as possible. If you manage dependencies through Maven or Gradle, update the artifact version to the first release containing the fix.

# Maven: pin to the fixed version (replace TODO_FIXED_VERSION)
<dependency>
  <groupId>io.goobi.viewer</groupId>
  <artifactId>viewer-core</artifactId>
  <version>TODO_FIXED_VERSION</version>
</dependency>

# Gradle
dependencies {
  implementation("io.goobi.viewer:viewer-core:TODO_FIXED_VERSION")
}

# If you build a Docker image, update the application image tag or rebuild from the patched commit
docker pull TODO_VENDOR_IMAGE:TODO_FIXED_TAG
docker build -t your-app:patched .

Hardening while you patch:

# Apache httpd: block the vulnerable endpoint
<LocationMatch ^.*api/v[12]/index/stream.*$>
    Require all denied
</LocationMatch>

# Tomcat web.xml: deny access to the endpoint
<security-constraint>
  <web-resource-collection>
    <web-resource-name>blocked endpoint</web-resource-name>
    <url-pattern>/api/v1/index/stream</url-pattern>
    <url-pattern>/api/v1/index/stream/*</url-pattern>
  </web-resource-collection>
  <auth-constraint/>
</security-constraint>

Code fix example: if you maintain a fork or custom controller, remove the endpoint entirely or reject all streaming expressions from unauthenticated clients.

// Example defensive pattern
@PostMapping("/api/v1/index/stream")
public ResponseEntity<Void> stream(@RequestBody String body, Principal user) {
    if (user == null) {
        return ResponseEntity.status(401).build();
    }
    throw new ResponseStatusException(HttpStatus.GONE, "Endpoint removed");
}

Package-manager notes: this issue is Java/Maven-centric, so npm/yarn/pnpm, pip/pipx, apt/yum are not the primary remediation path unless your deployment wraps the Java service. If you package the app in Linux repos, update the underlying application package to the vendor-fixed build.

Detection & Verification

Check whether you are vulnerable:

# Search your source, config, or built artifacts for the endpoint
grep -RIn "/api/v1/index/stream\|index/stream" .

# Inspect dependency versions
mvn -q dependency:tree | grep -i "io.goobi.viewer:viewer-core"
./gradlew dependencies | grep -i "io.goobi.viewer:viewer-core"

# If deployed in a container, inspect the image labels or app manifest
docker image inspect your-app:tag --format '{{json .Config.Labels}}'

Verify the fix:

# The endpoint should return 404, 410, or a proxy/Tomcat denial
curl -i -X POST https://your-host/api/v1/index/stream -d 'test'

# Confirm the route is blocked at the edge
curl -i https://your-host/api/v1/index/stream

Look for signs of abuse: review reverse-proxy logs for unauthenticated POSTs to /api/v1/index/stream, unusual Solr query activity, unexpected metadata changes, and missing documents. If you have Solr audit logs, search for update() or delete() streaming expressions and any large-volume reads.

Risk and Impact

This flaw can expose the entire Solr index without authentication, including records that your application normally protects with access rules, moving walls, license checks, or IP restrictions. An attacker may also overwrite metadata, alter access-control fields, or delete documents outright, which can corrupt search results and force a full re-index. For solo developers and small teams, the biggest risk is silent data loss or integrity damage before anyone notices.

Keep reading