# CVE-2026-48528: Metacat unauthenticated SQL injection in REST API

Source: https://junglewise.ai/threats/cve-2026-48528-metacat-unauthenticated-sql-injection-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48528 · Severity: critical · CVSS 9.8 · Published 2026-08-14

Metacat is a data repository platform used by researchers to preserve, share, and discover scientific datasets. Versions 2.0.0 through 3.4.0 contain a critical SQL injection vulnerability in the REST API that allows attackers without authentication to extract sensitive data (including user credentials, access logs, and dataset metadata), modify data, or delete information from the underlying database. This fully compromises the confidentiality and integrity of all data stored in affected Metacat instances.

## Quick answers

**Is CVE-2026-48528 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48528 being exploited in the wild.

**How severe is CVE-2026-48528?** Critical severity, with a CVSS score of 9.8, published 14 August 2026.

**Which products and versions are affected?** UCSB Metacat 2.0.0 through 3.4.0.

**Is there a fix for CVE-2026-48528?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48528 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48528?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unauthenticated SQL injection in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints, caused by unsanitized user input in the `nodeId` parameter that is directly appended to SQL queries without parameterization. The backend PostgreSQL database returns error messages containing query results, which Metacat mirrors back to the caller in XML error responses; attackers can weaponize this via PostgreSQL `CAST` functions or similar error-generating constructs to exfiltrate arbitrary data. The attack requires no authentication and can also execute INSERT, UPDATE, and DELETE statements for complete database compromise. The vulnerability was fully remediated in version 3.4.1; interim mitigation is available by disabling the `/cn` endpoints via servlet configuration in the application's web.xml file.

## Affected products

- UCSB Metacat 2.0.0 through 3.4.0

## Timeline

- 2026-08-14: disclosed