Executive brief
Metacat is a data repository platform used by researchers to preserve, share, and discover scientific datasets. Versions 2.0.0 through 3.4.0 contain a critical SQL injection vulnerability in the REST API that allows attackers without authentication to extract sensitive data (including user credentials, access logs, and dataset metadata), modify data, or delete information from the underlying database. This fully compromises the confidentiality and integrity of all data stored in affected Metacat instances.
Technical details
The vulnerability is an unauthenticated SQL injection in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints, caused by unsanitized user input in the `nodeId` parameter that is directly appended to SQL queries without parameterization. The backend PostgreSQL database returns error messages containing query results, which Metacat mirrors back to the caller in XML error responses; attackers can weaponize this via PostgreSQL `CAST` functions or similar error-generating constructs to exfiltrate arbitrary data. The attack requires no authentication and can also execute INSERT, UPDATE, and DELETE statements for complete database compromise. The vulnerability was fully remediated in version 3.4.1; interim mitigation is available by disabling the `/cn` endpoints via servlet configuration in the application's web.xml file.
Affected products
- UCSB Metacat 2.0.0 through 3.4.0
Timeline
- 2026-08-14: disclosed