CVE-2026-48114: Metacat has an unauthenticated SQL injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability exists in Metacat, the NCEAS data repository software, affecting versions 2.0.0 through 2.x (fixed in 3.0.0). The flaw is reachable over the network with no credentials required: the /harvesterRegistration endpoint passes attacker-controlled request parameters directly into a raw SQL INSERT via unsafe string concatenation, bypassing the intended LDAP identity check. Successful exploitation gives an attacker full read, write, and query-execution access to the underlying PostgreSQL database. A patched-image rebuild at Metacat 3.0.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable /harvesterRegistration endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the Metacat service.

• AuthenticationNot required

  The servlet does not enforce LDAP identity verification, so no account or session token is needed to reach the injection sink.

• Victim interactionNot required

  The attack is fully server-side; no user action, click, or social-engineering step is required.

• Attack complexityDetail

  Exploitation is reliable and condition-free: crafting a malicious request parameter requires no race condition, memory layout knowledge, or environmental setup.

Blast Radius

• Reads all data stored in the Metacat PostgreSQL database, including research datasets, user records, and configuration tables.
• Modifies or deletes persisted database rows, including schedule records, dataset metadata, and access-control entries.
• Executes stacked SQL statements via Statement.executeUpdate(), enabling the attacker to invoke database-level functions and alter schema objects.
• Combines read and write access to exfiltrate sensitive researcher contact information and corrupt or destroy the integrity of stored scientific data.