# CVE-2026-48114: NCEAS Metacat SQL injection in harvesterRegistration endpoint

Source: https://junglewise.ai/threats/cve-2026-48114-nceas-metacat-sql-injection-in-harvesterregistration-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-48114 · Severity: critical · CVSS 9.8 · Published 2026-06-15

Metacat is a data repository used by researchers to store and share scientific data. A security flaw in its registration component allows unauthorized individuals to run malicious database commands over the network. This could lead to the theft of sensitive research data, exposure of user credentials, or complete deletion of the repository's database.

Technologies: [NCEAS Metacat](https://junglewise.ai/threats/technologies/metacat). Vendors: [NCEAS](https://junglewise.ai/threats/vendors/nceas).

## Quick answers

**Is CVE-2026-48114 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48114 being exploited in the wild.

**How severe is CVE-2026-48114?** Critical severity, with a CVSS score of 9.8, published 15 June 2026.

**Which products and versions are affected?** NCEAS Metacat 2.0.0 to 2.19.1.

**Is there a fix for CVE-2026-48114?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48114 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48114?** Check whether you run NCEAS Metacat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated SQL injection vulnerability exists in Metacat 2.x within the HarvesterRegistration.dbInsert() method. The application uses string concatenation with a flawed quoteString() helper that fails to escape single quotes when building INSERT statements against the HARVEST_SITE_SCHEDULE table. Attackers can inject malicious SQL via the 'unit', 'contactEmail', or 'documentListURL' parameters. Because the underlying PostgreSQL backend supports stacked queries, this allows for full read, write, and execute permissions within the database context. The vulnerability was addressed in version 3.0.0 by removing the affected harvesterClient package.

## Affected products

- NCEAS Metacat 2.0.0 to 2.19.1

## Timeline

- 2026-06-15: advisory: NVD publication date
- 2026-05-27: disclosed: GitHub Security Advisory published

## References

- [https://github.com/NCEAS/metacat/commit/820d595309b399fdbdf4983bd1b1dd795773472a](https://github.com/NCEAS/metacat/commit/820d595309b399fdbdf4983bd1b1dd795773472a)
- [https://github.com/NCEAS/metacat/security/advisories/GHSA-wrc6-rc34-hrcg](https://github.com/NCEAS/metacat/security/advisories/GHSA-wrc6-rc34-hrcg)

## Related threats

- [NCEAS Metacat path traversal disclosure in Solr query handler](https://junglewise.ai/threats/cve-2026-50022-nceas-metacat-path-traversal-disclosure-in-solr-query-handler)