What is the CVSS score of CVE-2026-48114?

CVE-2026-48114 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Metacat are affected by CVE-2026-48114?

NCEAS Metacat (versions 2.0.0 through pre-3.0.0) is vulnerable to unauthenticated SQL injection affecting the /harvesterRegistration endpoint; no public exploit identified at time of analysis, but…. A patch is available.

How to fix or mitigate CVE-2026-48114?

WITHIN 24 HOURS: Identify all systems running Metacat 2.0.0-pre-3.0.0 and immediately restrict network access to the /harvesterRegistration endpoint using firewall rules or network ACLs. Disable the endpoint entirely if harvester registration is not in active use. WITHIN 7 DAYS: Deploy WAF rules to block requests with suspicious parameter patterns to /harvesterRegistration; implement database access logging and alerting for unusual queries; assess logs for signs of prior exploitation (malformed SQL, UNION queries, stacked statements). WITHIN 30 DAYS: Test and plan migration to Metacat 3.0.0 or later; if upgrade unavailable, perform full security audit of database access controls and consider application-level input validation patches as interim measure.

Metacat CVE-2026-48114

EUVD-2026-36795 CRITICAL

SQL Injection (CWE-89)

2026-06-15 GitHub_M

PostgreSQL SQLi Metacat

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Servlet skips LDAP auth (PR:N), reachable over HTTP (AV:N) with a single crafted request (AC:L), and stacked-query SQLi yields full DB read/write/execute (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 15, 2026 - 21:01 EUVD

Source Code Evidence Fetched

Jun 15, 2026 - 19:55 vuln.today

Analysis Generated

Jun 15, 2026 - 19:55 vuln.today

CVE Published

Jun 15, 2026 - 18:52 cve.org

CRITICAL 9.8

DescriptionCVE.org

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.

Articles & Coverage 1

News Critical SQL Injection in PostgreSQL via NCEAS Metacat - CVE-2026-48114 Jun 15, 2026

AnalysisAI

Unauthenticated SQL injection in NCEAS Metacat 2.0.0 through pre-3.0.0 allows remote attackers to read, modify, and execute arbitrary statements against the PostgreSQL backend by sending crafted parameters to the /harvesterRegistration endpoint. The flaw stems from string-concatenated INSERTs in HarvesterRegistration.dbInsert() combined with a missing LDAP identity check, and because the backend permits stacked queries via Statement.executeUpdate() the injection escalates to full database compromise. No public exploit identified at time of analysis, but the CVSS 9.8 vector and trivial trigger via three reachable parameters (unit, contactEmail, documentListURL) make exploitation straightforward once the endpoint is reachable.

Technical ContextAI

Metacat is a Java-based metadata and data repository operated primarily by ecological and earth-science researchers, fronted by a Java servlet container and backed by PostgreSQL (CPE cpe:2.3:a:nceas:metacat). The /harvesterRegistration servlet feeds user-supplied unit, contactEmail, and documentListURL parameters into HarvesterRegistration.dbInsert(), which constructs the INSERT against HARVEST_SITE_SCHEDULE through plain Java string concatenation. The only sanitization is a quoteString() helper that wraps values in single quotes without escaping embedded quotes, so any apostrophe terminates the literal and lets attacker-controlled SQL append. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command); because PostgreSQL's JDBC driver allows multiple semicolon-separated statements through executeUpdate(), a single injected payload can chain DDL, DML, and PostgreSQL-specific functions (e.g. COPY ... FROM PROGRAM on suitably privileged roles), giving full read/write/execute access in the database role context.

RemediationAI

Vendor-released patch: Metacat 3.0.0 - upgrade per the GitHub Security Advisory at https://github.com/NCEAS/metacat/security/advisories/GHSA-wrc6-rc34-hrcg, which corresponds to commit 820d595309b399fdbdf4983bd1b1dd795773472a that removes the entire vulnerable harvesterClient code path. If upgrading is not immediately possible, block external access to the /harvesterRegistration URL at the reverse proxy or servlet filter (trade-off: any legitimate site-harvest registration workflow will break, but most operational deployments rarely use this interactively), and as a defense-in-depth step ensure the Metacat database role has the minimum privileges required (no SUPERUSER, no pg_read_server_files, no COPY FROM PROGRAM) so that a successful injection cannot escalate to OS command execution. Disabling PostgreSQL stacked queries is not a viable mitigation since the JDBC driver and Metacat both rely on standard executeUpdate semantics.