Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection flaw that allows a remote attacker to inject arbitrary SQL commands through the nodeId parameter in the /cn/v1/object and /cn/v2/object REST endpoints. The flaw results in backend PostgresQL queries being formed without sanitization or parameterization, causing error messages to reflect injected SQL. As a result, an attacker can extract, modify, or delete any data from the underlying database, including catalog metadata, access logs, and personal identifiers. The vulnerability is a classic example of CWE‑89 (SQL Injection) combined with CWE‑287 (Improper Authentication) as the endpoints accept requests without prior authentication.

The affected vendor is NCEAS, product Metacat. All releases from 2.0.0 up to 3.4.0 are vulnerable; the issue was fixed in Metacat 3.4.1. No other vendors or versions are listed as affected.

The CVSS score of 9.8 places the flaw in the Critical severity band, and the lack of an EPSS score indicates the current exploit probability cannot be quantified but the absence of any KEV listing does not reduce its inherent risk. Because the vulnerable endpoints are exposed to any network client, the likely attack vector is an unauthenticated network interface. An attacker can exploit the flaw remotely, potentially compromising all data stored in the repository.