CVE-2026-48114 Metacat has an unauthenticated SQL injection vulnerability
Unauthenticated attackers can execute arbitrary SQL commands via the harvesterRegistration endpoint, leading to full database compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48114?
CVE-2026-48114 is a critical SQL injection vulnerability in NCEAS metacat, published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.
Which versions are affected by CVE-2026-48114?
How do I fix CVE-2026-48114?
No fix has been published for CVE-2026-48114 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-48114 being exploited?
There is no known exploitation of CVE-2026-48114 in the wild and no public exploit code.
Sources
Also known as GHSA-wrc6-rc34-hrcg.