CVE-2026-50022: Metacat acts as unintended proxy to backend Apache SOLR engine
Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An unauthenticated client can select the /admin/file handler, and SolrJ reformats the parameter into a request accepted even when handleSelect=false is configured on Solr 7.0 or later. When Solr returns the selected core configuration file, Metacat embeds the raw content in an XML processing error response, disclosing internal files such as solrconfig.xml and enabling infrastructure profiling. This issue is fixed in version 3.4.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Metacatto a version that resolves this vulnerability.Fixed in 3.4.2
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated disclosure?
Metacat versions before 3.4.2 with reachable search endpoints such as /d1/mn/v2/query/solr/ are exposed. No authentication is required for an attacker to send the controlled query parameter.
Does disabling Solr's select handler prevent this issue?
No. On Solr 7.0 or later, the request is reformatted by SolrJ and accepted even when handleSelect=false is configured.
What information can be disclosed?
An attacker can select Solr's /admin/file handler and cause returned core configuration content to be included raw in an XML processing error response. This can disclose files such as solrconfig.xml and support profiling of internal infrastructure.
What is the remediation?
Upgrade Metacat to version 3.4.2, which fixes the issue.