Apache Solr exposure: 810,266 fingerprint matches against 73,029 title matches

A search engine with an administrative API

Solr is a search platform that exposes a substantial administrative API alongside its query endpoints. Core administration, configuration upload and in some configurations remote streaming of data are all reachable through that API, which means an exposed instance is a data exposure question and a code execution question at the same time.
Its history includes advisories that were exploited in the wild, which is why operators track this population closely.

What was queried

Three queries against ZoomEye on 2026-09-26 (UTC), Python SDK, sub_type=all, page size one:

app="Apache Solr": 810,266
title="Solr": 73,029
port=8983: 1,319,525

Why the largest number is the least specific

The port query returns 1.3 million matches, which describes every service answering on 8983 rather than Solr installations. Whatever the port was originally assigned to, it now carries enough unrelated traffic that it should not stand in for a product inventory.
The fingerprint and the title query differ by a factor of eleven, and the direction is the opposite of what a naive expectation would suggest: the fingerprint is far larger. Solr's administrative interface does not always render a distinctive page title, because deployments frequently place it behind a proxy or front it with a custom path, while the application signature recognises the response structure that the service produces regardless of the presentation layer.
The practical conclusion: for Solr, the fingerprint is the primary measurement and the title query is a lower bound.

What operators should verify

Authentication. Solr's administrative API should never be reachable without authentication. The vendor's security documentation describes the authentication and authorisation plugins available, and enabling one is the baseline rather than an enhancement.
Network placement. Where Solr is used internally, the administrative endpoint belongs on the internal network or behind a proxy that enforces access control, not on the same listener as the query interface.
Version state. The project publishes security information alongside releases, and the relevant question for any measured instance is which version is running, which the count cannot answer.
Access control on the query interface as well. A search endpoint that returns documents from an index built over sensitive sources is a data disclosure path even when administration is locked down.

Limitations

The counts are point-in-time matches and say nothing about version, authentication state, or the content of any index. Nothing here establishes that a matched instance is vulnerable to any specific issue, and the port figure excludes the interpretation that it measures Solr.