Port reference
Port 8983 (TCP) – Apache Solr
Default port for the Apache Solr search platform and its admin/API interface.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Solr commonly listens on 0.0.0.0:8983 with the admin UI and APIs unauthenticated. Exposed instances allow data access and, on vulnerable versions, remote code execution.
What is port 8983 used for?
Port 8983 is the default for Apache Solr, a popular open-source search platform built on Lucene. Applications query and index documents over this port, and the same port serves the Solr admin UI and the management APIs used to create cores, edit configuration, and import data. It is the single port most Solr clients and the admin dashboard connect to.
When would you open it?
Open or forward 8983 when your application servers or operators on other machines need to search or manage a Solr instance. It normally lives on a private network alongside the apps that use it rather than being exposed to the internet.
Is it safe to open?
Solr often runs without authentication and its admin APIs are powerful, so an exposed instance can leak data or worse; enable authentication and keep it on a trusted network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8983
nmap -p 8983 <target>netstat -ano | findstr :8983
Test-NetConnection <host> -Port 8983lsof -i :8983
nmap -p 8983 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8983 to your device's local IP, internal port 8983, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8983/tcpsudo firewall-cmd --permanent --add-port=8983/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8983 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8983" -Direction Inbound -Protocol TCP -LocalPort 8983 -Action AllowSecurity & risks
Common attacks
- Remote code execution via Velocity template injection (CVE-2019-17558)
- RCE via the config API and data import handler (CVE-2017-12629)
- Unauthenticated access to the admin UI and core data
- Information disclosure of cores, schemas, and indexed documents
Hardening
- Enable authentication and authorization (Solr security.json)
- Bind to localhost or a private interface; never expose 8983 to the internet
- Disable the Velocity response writer and unused handlers
- Require TLS and firewall 8983 to trusted hosts
- Keep Solr patched (fixes CVE-2019-17558 and CVE-2017-12629) and audit access
How to block this port
sudo ufw deny 8983/tcpsudo firewall-cmd --permanent --remove-port=8983/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8983 -j DROPNew-NetFirewallRule -DisplayName "Block 8983" -Direction Inbound -Protocol TCP -LocalPort 8983 -Action Blocknmap snippet
nmap -p8983 --script http-title <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is an exposed Solr admin on port 8983 dangerous?
- The Solr admin UI and APIs are often unauthenticated. Bugs like CVE-2019-17558 (Velocity template injection) and CVE-2017-12629 allow remote code execution, so an exposed 8983 can lead to full server compromise.
- How do I secure Apache Solr?
- Enable authentication via security.json, bind to a private interface, disable the Velocity response writer and unused handlers, require TLS, firewall 8983, and keep Solr patched.