CVE-2026-48114: Metacat has an unauthenticated SQL injection vulnerability
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVESTSITESCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Metacatto a version that resolves this vulnerability.Fixed in 3.0.0 - Configuration
Require and verify a real LDAP identity (enable authentication/authorization) for requests to the /harvesterRegistration servlet to prevent unauthenticated inserts.
Metacat /harvesterRegistration servlet LDAP identity verification / authentication = enabled - Compensating control
Restrict access to the /harvesterRegistration endpoint using network controls (firewall, ACLs, or WAF) so only trusted hosts or management networks can reach it until the application is patched.
- Operational
Audit the Metacat database for unauthorized changes or suspicious activity, restore from known-good backups if compromise is found, and rotate any credentials or secrets that may have been exposed as a result of the vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48114?
CVE-2026-48114 has a severity rating of 9.8, categorized as critical.
How do I fix CVE-2026-48114?
To mitigate CVE-2026-48114, update to a patched version of Metacat that addresses the SQL injection vulnerability.
What is the impact of CVE-2026-48114?
CVE-2026-48114 allows unauthenticated attackers to execute SQL injection attacks on the Metacat application.
Which versions of Metacat are affected by CVE-2026-48114?
CVE-2026-48114 affects Metacat versions 2.0.0 and above.
What kind of vulnerability is CVE-2026-48114?
CVE-2026-48114 is classified as an unauthenticated SQL injection vulnerability.