External risk intelligence

Metacat SQL Injection via Unauthenticated API Endpoints

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-48528

Metacat is data repository software designed to preserve, share, and discover data. The vulnerability resides in REST API endpoints that are part of the application's core functionality, which are typically exposed as web-accessible interfaces for researchers and data systems to interact with the repository over the network.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Metacat data repository software, specifically within its REST API endpoints. This unauthenticated SQL injection flaw allows for the potential exfiltration, alteration, or deletion of sensitive data, including management information, access logs, and user identification details.

Unauthenticated attackers can exploit Metacat APIs to steal or change data.
Protects sensitive research data and user information from compromise.
Confirm Metacat usage and exposure to potential data compromise.

Attack Path

How an attacker could exploit the issue

An attacker can target Metacat's REST API endpoints without needing any authentication. By sending specially crafted requests with malicious SQL commands in the `nodeId` parameter, an attacker can trick the application into executing arbitrary SQL queries. Metacat then reflects the database's error messages, which include the results of the injected SQL, directly back to the attacker, allowing them to steal, alter, or delete sensitive data.

Unauthenticated network access required.
Malicious input to API endpoints.
Data exfiltration, modification, or deletion.

Live Threat

Current exploitation, exposure, and threat context

The Metacat data repository software has an unauthenticated SQL injection vulnerability in its REST API endpoints, allowing attackers to execute arbitrary SQL commands. This could lead to the extraction, modification, or deletion of all data stored within the Metacat database, including sensitive management, access, and identifying information.

Sensitive data and system integrity.
Via unsanitized user input in API calls.
Full database compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Data repository software like Metacat, used for preserving, sharing, and discovering data, can be a critical component for research institutions. In this case, the vulnerability lies within unauthenticated REST API endpoints, suggesting that infrastructure and security teams are likely involved in managing access and exposure. The first practical step is to identify all Metacat instances, confirm their network reachability and business criticality, and then locate the accountable owner for remediation.

Identify Metacat data repository owners.
Verify `/cn/v1/object` and `/cn/v2/object` endpoint exposure.
Disable endpoints or plan upgrade to version 3.4.1.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Metacat?

Metacat is a specialized data repository software used by research communities to archive, manage, and share scientific datasets. It acts as a digital library, allowing researchers to discover and interact with data through web interfaces and APIs. By providing structured storage and retrieval mechanisms, it helps organizations maintain the integrity and accessibility of research information.

How does CVE-2026-48528 work?

This vulnerability is an SQL injection flaw (CWE-89). It occurs when the software takes user input for the 'nodeId' parameter and directly includes it in database queries without cleaning it first. Because the application returns detailed database errors to the user, an attacker can intentionally trigger these errors to force the database to reveal secret information or execute unauthorized commands.

Can I trigger this without special permissions?

Yes. This vulnerability does not require authentication, meaning anyone with network access to the affected API endpoints can attempt to exploit it. It is important to note that simply visiting the main Metacat website or browsing repository contents does not necessarily trigger this; the exploit specifically targets the REST API endpoints used for programmatic data interaction.

Is my Metacat instance at risk?

According to Halo Surface Signal, this vulnerability is critical because it exists in core REST API endpoints. These endpoints are designed for network interaction, making them highly susceptible if they are exposed to the internet. If your instance is internet-facing or reachable by untrusted networks, the risk of unauthorized data access or modification is high.

How should I respond to this vulnerability?

First, identify all active Metacat instances in your environment. If you cannot update to version 3.4.1 immediately, verify if your deployment requires the '/cn/v1/object' or '/cn/v2/object' API endpoints. If these are not essential for your operations, you can mitigate the risk by disabling these specific API paths within your web server configuration.

References

github.com/NCEAS/metacat/security/advisories/GHSA-6g6j-wh5h-77h5

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.