EUVD-2026-36795Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Servlet skips LDAP auth (PR:N), reachable over HTTP (AV:N) with a single crafted request (AC:L), and stacked-query SQLi yields full DB read/write/execute (C:H/I:H/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in NCEAS Metacat 2.0.0 through pre-3.0.0 allows remote attackers to read, modify, and execute arbitrary statements against the PostgreSQL backend by sending crafted parameters to the /harvesterRegistration endpoint. The flaw stems from string-concatenated INSERTs in HarvesterRegistration.dbInsert() combined with a missing LDAP identity check, and because the backend permits stacked queries via Statement.executeUpdate() the injection escalates to full database compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the Metacat servlet's /harvesterRegistration endpoint on a Metacat 2.0.0-2.x deployment backed by PostgreSQL with stacked queries enabled (the JDBC default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to a real, high-priority issue rather than an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Metacat web interface sends a single HTTP POST to /harvesterRegistration with a unit, contactEmail, or documentListURL field containing a closing single quote followed by stacked SQL such as `'); UPDATE xml_documents SET docid='attacker'; --`. Because the servlet skips LDAP authentication and the quoteString() helper does not escape the embedded quote, the injected statements execute under the Metacat PostgreSQL role, allowing data exfiltration, tampering with metadata records, or pivoting to OS-level commands if the DB role is over-privileged. … |
| Remediation | Vendor-released patch: Metacat 3.0.0 - upgrade per the GitHub Security Advisory at https://github.com/NCEAS/metacat/security/advisories/GHSA-wrc6-rc34-hrcg, which corresponds to commit 820d595309b399fdbdf4983bd1b1dd795773472a that removes the entire vulnerable harvesterClient code path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
WITHIN 24 HOURS: Identify all systems running Metacat 2.0.0-pre-3.0.0 and immediately restrict network access to the /harvesterRegistration endpoint using firewall rules or network ACLs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
SQL injection in n8n's legacy Postgres v1 and TimescaleDB workflow nodes allows an authenticated workflow editor to inje
Privilege escalation in PostgreSQL Anonymizer versions prior to 3.1.1 allows a low-privileged database user to achieve s
Share
External POC / Exploit Code
Leaving vuln.today