Critical SQL Injection in Metacat (CVE‑2026‑48528) – Immediate Mitigation Steps

Executive summary

Metacat versions 2.0.0 through 3.4.0 expose an unauthenticated SQL injection flaw in the /cn/v1/object and /cn/v2/object REST endpoints. By tampering with the nodeId parameter, an attacker can trigger database errors that echo back arbitrary query results, or execute full SQL statements (SELECT, INSERT, UPDATE, DELETE). The bug gives complete read‑write control over the PostgreSQL backend, compromising catalog metadata, access logs, personal identifiers (ORCID), IP addresses, and access‑control settings. The issue is fixed in Metacat 3.4.1; where upgrade is not feasible, disabling the /cn endpoints mitigates risk.

What is affected

• Product: Metacat data‑repository software
• Versions: 2.0.0 – 3.4.0 (inclusive)
• Endpoints: /cn/v1/object and /cn/v2/object
• Parameter: nodeId
• Database: PostgreSQL (any version used by Metacat)
• Deployments: Primarily DataONE Coordinating Nodes, but any Metacat instance exposing the /cn API is vulnerable.

Severity and evidence

• Severity: Critical – unauthenticated attacker can read, modify, or delete any data.
• Evidence: Proof‑of‑concept attacks demonstrate error‑based data exfiltration using the PostgreSQL CAST function and arbitrary statement execution. The vulnerability is confirmed by NVD (CVE‑2026‑48528).
• Impact: Full database compromise, exposing sensitive research identifiers and potentially corrupting scientific datasets.

Business or operational impact

• Loss of integrity for research data catalogs, jeopardizing reproducibility.
• Exposure of personal researcher information (ORCID, IP) may violate privacy regulations.
• Manipulated access‑control entries could allow unauthorized data downloads or deletions, disrupting collaborative projects.
• For institutions relying on DataONE, the breach could erode trust among data providers and users.

Detection considerations

• Monitor web server logs for requests to /cn/v1/object or /cn/v2/object that contain unusual nodeId values (e.g., SQL keywords, quotes, or CAST).
• Enable PostgreSQL query logging and look for error messages that contain injected payload fragments.
• Deploy an application‑layer WAF rule that blocks requests where nodeId does not match the expected numeric or UUID pattern.
• Review Metacat audit logs for unexpected error responses that include XML payloads with SQL snippets.

Recommended defensive actions

1. Upgrade immediately to Metacat 3.4.1 or later, which sanitizes the nodeId parameter and uses prepared statements.
2. If upgrade cannot be performed:

• Disable the vulnerable /cn REST endpoints by removing their servlet and servlet‑mapping entries from web.xml (e.g., CNRestServlet classes).
• Restart the servlet container (Tomcat, Jetty, etc.) after changes.

1. Apply a temporary WAF rule to reject requests containing SQL meta‑characters in nodeId.
2. Conduct a post‑remediation audit to verify that no unauthorized data changes occurred.

Workarounds or mitigations, if supported

• Endpoint disablement: Removing the servlet mapping for /cn does not affect typical repository functionality, as member repositories rarely use these endpoints.
• Input validation: If custom code modifications are possible, enforce strict type checking on nodeId (numeric/UUID) and employ parameterized queries.
• Database hardening: Restrict the Metacat database user to the minimum required privileges; avoid SUPERUSER rights.

Patch or remediation status

• Fixed version: Metacat 3.4.1 (released after CVE‑2026‑48528 disclosure).
• Vendor statement: The issue is fully remediated in 3.4.1; no partial patches are available.
• Current status: Organizations should verify their deployment version and apply the upgrade or the endpoint‑disablement workaround.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-48528
• Metacat release notes (3.4.1): https://metacat.org/releases/3.4.1
• DataONE documentation on Coordinating Node APIs: https://www.dataone.org/api

Publication date and last checked date

• Publication date: 2026-09-18
• Last checked: 2026-09-19