PatchSiren cyber security CVE debrief

CVE-2026-48114 NCEAS CVE debrief

A critical vulnerability was discovered in Metacat, a data repository software used for preserving, sharing, and discovering data. The issue, tracked as CVE-2026-48114, is an unauthenticated SQL injection vulnerability that affects versions 2.0.0 and above. The vulnerability is located in the /harvesterRegistration endpoint, where the HarvesterRegistration.dbInsert() function builds an INSERT statement against the HARVEST_SITE_SCHEDULE table using string concatenation. This allows an attacker to inject malicious SQL code through three request parameters: unit, contactEmail, and documentListURL. The vulnerability has a CVSS score of 9.8 and is considered critical. The PostgreSQL backend used by Metacat permits stacked queries via Statement.executeUpdate(), which enables an attacker to gain full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat version 3.0.0.