CVE-2026-48528 NCEAS CVE debrief

Who should care

Defenders responsible for Metacat deployments, particularly in the DataONE network, should be aware of this vulnerability and take immediate action to upgrade to Metacat version 3.4.1 or apply the mitigation strategy. This vulnerability can lead to critical data exposure and potential full database compromise.

Why it matters

This SQL injection vulnerability in Metacat versions 2.0.0 through 3.4.0 allows unauthenticated attackers to extract arbitrary data from the PostgreSQL database, potentially leading to full exposure of protected information and full compromise of all data in the database. Defenders responsible for Metacat deployments should take immediate action to upgrade to Metacat version 3.4.1 or apply the mitigation strategy.

• Potential extraction of arbitrary data from the underlying PostgreSQL database
• Full exposure of protected information to the attacker
• Potential full compromise of all data in the database
• Verification of remediation by upgrading to Metacat version 3.4.1 or applying the mitigation strategy

Technical summary

The SQL injection vulnerability in Metacat versions 2.0.0 through 3.4.0 is caused by unsanitized user input in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints. This allows attackers to inject SQL commands and extract arbitrary data from the underlying PostgreSQL database, potentially leading to full exposure of protected information and full compromise of all data in the database. The vulnerability can be remediated by upgrading to Metacat version 3.4.1 or applying a mitigation strategy for versions prior to 3.4.1. Defenders responsible for Metacat deployments, particularly in the DataONE network, should take immediate action to upgrade or apply the mitigation strategy.

Defensive priority

High priority should be given to upgrading to Metacat version 3.4.1 or applying the mitigation strategy for versions prior to 3.4.1, as the vulnerability allows for critical data exposure and potential full database compromise.

Recommended defensive actions

• Upgrade to Metacat version 3.4.1 or later
• Disable the `/cn` REST endpoints in the webapp deployment as a mitigation strategy for versions prior to 3.4.1
• Review and update access control information to prevent unauthorized access
• Confirm whether affected Metacat deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and the remediation strategy. A source reference from GitHub provides additional context on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.