CVE-2026-48114 Details
Description
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.
A critical unauthenticated SQL injection vulnerability has been identified in Metacat versions 2.0.0 through 2.19.1, specifically within the '/harvesterRegistration' endpoint. The issue arises because the 'HarvesterRegistration.dbInsert()' method constructs SQL INSERT statements for the 'HARVEST_SITE_SCHEDULE' table by concatenating strings. This process uses a 'quoteString()' helper that adds single quotes without proper escaping, leaving the application open to SQL injection attacks. The vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized access or manipulation of the Metacat database, including sensitive information such as credentials and session data.
The vulnerability has been patched in Metacat version 3.0.0. Users are advised to upgrade to Metacat version 3.0.0 or later, preferably the latest release. For those unable to upgrade, access to the vulnerable 1.x API servlets can be disabled or restricted, although this may impact functionality depending on specific client needs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 15, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NCEAS/metacat/commit/820d595309b399fdbdf4983bd1b1dd795773472a | [email protected] | Source CodeVendor |
| https://github.com/NCEAS/metacat/security/advisories/GHSA-wrc6-rc34-hrcg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NCEAS Metacat | <= 2.19.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | New CVE Received | [email protected] |