Read the docs
TI-2026-35554 Aliases CVE-2026-48114

Metacat has an unauthenticated SQL injection vulnerability

Priority MEDIUM 49CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287 and CWE-89.

Summary

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0037 31st percentileScored 2026-11-07
Fix Fixed metacat (NCEAS): 3.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NCEASmetacat2.0.0 to before 3.0.03.0.0Patch availableCNA
  • metacat VendorNCEAS Affected 2.0.0 to before 3.0.0 Fixed in 3.0.0 Patch available CNA

Remediation

  • Fix · CNA metacat (NCEAS) Fixed in 3.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48114

References

Other 2

  • TI-2026-35888 Metacat has an unauthenticated SQL injection vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-35254 unauthenticated path traversal in Metacat 2.x CVSS 3.1CRITICAL 9.3
  • TI-2026-36848 Metacat acts as unintended proxy to backend Apache SOLR engine CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences