Unauthenticated SQL injection in Metacat REST API endpoints (CVE-2026-48528)

Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints. The `nodeId` parameter is appended to backend SQL queries without sanitization or parameterization, and SQL error responses are returned in XML error messages, enabling data exfiltration. Unauthenticated attackers can extract arbitrary data from the underlying PostgreSQL database or execute INSERT, UPDATE, and DELETE statements, resulting in full compromise of all data in the database. Affected versions: - >= 2.0.0, <= 3.4.0 We recommend updating to: >= 3.4.1. CVSS 9.8 · our assessment: act_now Reference: https://github.com/NCEAS/metacat/security/advisories/GHSA-6g6j-wh5h-77h5 Details: https://vuln.today/cve/CVE-2026-48528