Metacat acts as unintended proxy to backend Apache SOLR engine
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An unauthenticated client can select the /admin/file handler, and SolrJ reformats the parameter into a request accepted even when handleSelect=false is configured on Solr 7.0 or later. When Solr returns the selected core configuration file, Metacat embeds the raw content in an XML processing error response, disclosing internal files such as solrconfig.xml and enabling infrastructure profiling. This issue is fixed in version 3.4.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA metacat (NCEAS) Fixed in 3.4.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50022
References
More NCEAS vulnerabilities
- TI-2026-35888 Metacat has an unauthenticated SQL injection vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-35554 Metacat has an unauthenticated SQL injection vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-35254 unauthenticated path traversal in Metacat 2.x CVSS 3.1CRITICAL 9.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences