A critical SQL injection vulnerability exists in Metacat versions 2.0.0 through 3.4.0, affecting data repository software used for preserving, sharing, and discovering data. The vulnerability is located in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints, allowing unauthenticated attackers to inject SQL commands and extract arbitrary data from the underlying PostgreSQL database. This can lead to [truncated]
A critical vulnerability was discovered in Metacat, a data repository software used for preserving, sharing, and discovering data. The issue, tracked as CVE-2026-48114, is an unauthenticated SQL injection vulnerability that affects versions 2.0.0 and above. The vulnerability is located in the /harvesterRegistration endpoint, where the HarvesterRegistration.dbInsert() function builds an INSERT statement ag [truncated]
