Vulnerability · Published Jun 15, 2026 · Assigned by GitHub_M

CVE-2026-48114Metacat has an unauthenticated SQL injection vulnerability

Critical 9.8

In plain English

A critical-severity SQL injection in metacat from NCEAS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.4%top 68.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.

Affected products (as reported)

Vendor	Product	Versions
NCEAS	metacat	>= 2.0.0, < 3.0.0

Weakness: CWE-89, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/NCEAS/metacat/security/advisories/GHSA-wrc6-rc34-hrcg x_refsource_CONFIRM
https://github.com/NCEAS/metacat/commit/820d595309b399fdbdf4983bd1b1dd795773472a x_refsource_MISC