CVE-2026-48528

Name of the Vulnerable Software and Affected Versions Metacat versions 2.0.0 through 3.4.0

Description Unauthenticated SQL injection exists in the /cn/v1/object and /cn/v2/object REST API endpoints. The issue occurs because the software appends user-supplied data to SQL queries without sanitization or parameterization. An attacker can modify the nodeId parameter to execute arbitrary SQL commands against the backend PostgresQL database. This allows for the extraction of protected information by leveraging error reporting mechanisms that mirror SQL error responses in XML messages, such as using the CAST function to generate errors containing subquery results. Additionally, attackers can execute statements to insert, update, or delete data, leading to a full compromise of the database, including data catalog management, access logs, ORCID identifiers, client IP addresses, and access control information.

Recommendations Update Metacat to version 3.4.1. As a temporary mitigation, disable the /cn REST endpoints by removing the servlet and servlet-mapping for edu.ucsb.nceas.metacat.restservice.v1.CNRestServlet and edu.ucsb.nceas.metacat.restservice.v2.CNRestServlet in the servlet engine (e.g., removing the relevant servlet-mapping elements from the web.xml file in Tomcat).