CVE-2026-48114: Metacat SQL Injection Vulnerability

CVE-2026-48114 Overview

CVE-2026-48114 is an unauthenticated SQL injection vulnerability in Metacat, the open-source data repository software developed by the National Center for Ecological Analysis and Synthesis (NCEAS). The flaw resides in the /harvesterRegistration endpoint, where the HarvesterRegistration.dbInsert() method builds SQL statements against the HARVEST_SITE_SCHEDULE table using string concatenation. The quoteString() helper wraps user input in single quotes without escaping embedded quotes. Three request parameters reach the sink: unit, contactEmail, and documentListURL. Because the servlet does not verify a real Lightweight Directory Access Protocol (LDAP) identity, any remote attacker can trigger the injection. Versions 2.0.0 and later are affected; Metacat 3.0.0 contains the fix.

Critical Impact
An unauthenticated remote attacker can execute arbitrary SQL via stacked queries against the Metacat PostgreSQL database, gaining full read, write, and execute access in the database context.

Affected Products

Metacat versions 2.0.0 through 2.x (all releases at or above 2.0.0)
Metacat HarvesterRegistration servlet component
Metacat deployments using PostgreSQL as the backend

Discovery Timeline

2026-06-15 - CVE-2026-48114 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48114

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the Metacat harvester client registration workflow. The servlet handling /harvesterRegistration accepts the unit, contactEmail, and documentListURL request parameters and passes them directly into a dynamically constructed INSERT statement targeting the HARVEST_SITE_SCHEDULE table. The quoteString() helper wraps each value in single quotes but does not escape user-supplied single quotes, allowing an attacker to break out of the string literal.

The PostgreSQL JDBC driver permits stacked queries through Statement.executeUpdate(). An attacker can append additional SQL statements separated by semicolons after closing the original INSERT. This expands the impact beyond data tampering to arbitrary statement execution within the database context.

Root Cause

Two defects combine to produce the vulnerability. First, HarvesterRegistration.dbInsert() builds SQL through string concatenation instead of parameterized prepared statements. Second, the servlet does not enforce LDAP authentication before invoking the database insert path. An attacker reaches the injectable sink without credentials and without identity validation.

Attack Vector

The attacker sends a crafted HTTP request to the /harvesterRegistration endpoint with malicious payloads in any of the three injectable parameters. Because the backend uses executeUpdate() against PostgreSQL with stacked query support, the attacker can read sensitive metadata, modify repository records, escalate access by creating administrative entries, or invoke PostgreSQL functions for further impact.

java

// Vulnerable pattern (conceptual) - removed in Metacat 3.0.0
// HarvesterRegistration.dbInsert() built SQL via string concatenation:
//   INSERT INTO HARVEST_SITE_SCHEDULE (..., unit, contactEmail, documentListURL, ...)
//   VALUES (..., 'USER_UNIT', 'USER_EMAIL', 'USER_URL', ...)
// quoteString() wrapped values in single quotes without escaping.
// The fix removed the LTER harvester client entirely.
// Source: https://github.com/NCEAS/metacat/commit/820d595309b399fdbdf4983bd1b1dd795773472a

Detection Methods for CVE-2026-48114

Indicators of Compromise

HTTP requests to /harvesterRegistration containing single quotes, semicolons, or SQL keywords (UNION, SELECT, INSERT, UPDATE, DROP, --) in the unit, contactEmail, or documentListURL parameters.
Unexpected rows in the HARVEST_SITE_SCHEDULE table, or unexplained writes to other Metacat tables originating from the harvester registration workflow.
PostgreSQL audit log entries showing multiple statements executed in a single executeUpdate() call originating from the Metacat application user.

Detection Strategies

Inspect application and web server access logs for POST or GET requests targeting /harvesterRegistration from unauthenticated or untrusted source IPs.
Enable PostgreSQL statement logging (log_statement = 'all') on Metacat hosts and alert on stacked statements containing ; followed by DDL or DML.
Deploy web application firewall (WAF) rules to flag SQL metacharacters and common injection signatures on the harvester endpoint parameters.

Monitoring Recommendations

Monitor the Metacat database for schema changes, new privileged accounts, or unexpected function creations.
Track outbound network connections from the database host, since attackers may use PostgreSQL extensions to pivot.
Correlate web access logs with database query logs to identify request-to-query chains that indicate exploitation.

How to Mitigate CVE-2026-48114

Immediate Actions Required

Upgrade Metacat to version 3.0.0 or later, which removes the vulnerable harvester client code path.
Block external access to the /harvesterRegistration endpoint at the reverse proxy or WAF layer until the upgrade is complete.
Audit the HARVEST_SITE_SCHEDULE table and related Metacat tables for unauthorized entries and revert any malicious changes.
Rotate database credentials used by Metacat after confirming the environment is patched and clean.

Patch Information

The upstream fix was committed to the Metacat repository and released in Metacat 3.0.0. The patch removes the LTER harvester client, including HarvesterRegistrationLogin and HarvestDetailLog, eliminating the vulnerable code path entirely. See the GitHub Security Advisory GHSA-wrc6-rc34-hrcg and the remediation commit 820d595 for technical details.

Workarounds

Restrict access to /harvesterRegistration to trusted internal networks using firewall or reverse proxy ACLs.
Run Metacat with a least-privilege PostgreSQL role that cannot create roles, modify schemas, or execute administrative functions.
Apply WAF signatures that block SQL metacharacters in the unit, contactEmail, and documentListURL parameters.

bash

# Example nginx configuration to block external access to the vulnerable endpoint
location /metacat/harvesterRegistration {
    allow 10.0.0.0/8;        # internal management network only
    deny all;
    proxy_pass http://metacat_backend;
}