CVE-2026-50022

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50022
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50022.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50022
Aliases
  • GHSA-57g5-qq6w-7jr8
Published
2026-09-17T20:06:28Z
Modified
2026-09-19T08:14:25Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Metacat acts as unintended proxy to backend Apache SOLR engine
Details

Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An unauthenticated client can select the /admin/file handler, and SolrJ reformats the parameter into a request accepted even when handleSelect=false is configured on Solr 7.0 or later. When Solr returns the selected core configuration file, Metacat embeds the raw content in an XML processing error response, disclosing internal files such as solrconfig.xml and enabling infrastructure profiling. This issue is fixed in version 3.4.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-441"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50022.json"
}
References

Affected packages

Git / github.com/nceas/metacat

Affected ranges

Type
GIT
Repo
https://github.com/nceas/metacat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d500306188881d768b93f189bb8ddbf090f3f1ec
Fixed
1400210ea42a4f4d45aa0abbe6c4cc5606748d8f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.11.0
2.11.0-rc1
2.11.1
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.14.0
2.14.1
2.15.0
2.15.1
2.16.0
2.16.1
2.16.2
2.17.0
2.18.0
2.19.0
2.19.1
2.8.6
2.8.7
2.9.0
3.*
3.0.0
3.1.0
3.2.0
3.2.1
3.2.2
3.3.0
3.4.0
3.4.1
Other
METACAT_2_8_5
chart-1.*
chart-1.1.0
chart-1.1.1
chart-1.2.0
chart-2.*
chart-2.0.0
chart-2.1.0
chart-2.1.1
chart-2.1.2
chart-2.1.3
chart-3.*
chart-3.0.0
chart-4.*
chart-4.0.0
chart-4.1.0
chart-4.2.0
chart-4.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50022.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "229639444532973844835495978255863178924",
            "length": 1529
        },
        "id": "CVE-2026-50022-3828c5fa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/nceas/metacat/commit/d500306188881d768b93f189bb8ddbf090f3f1ec",
        "target": {
            "file": "src/edu/ucsb/nceas/metacat/index/MetacatSolrIndex.java",
            "function": "query"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "190719688899352225384538384270337598730",
            "length": 336
        },
        "id": "CVE-2026-50022-66600769",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/nceas/metacat/commit/d500306188881d768b93f189bb8ddbf090f3f1ec",
        "target": {
            "file": "src/edu/ucsb/nceas/metacat/index/MetacatSolrIndex.java",
            "function": "query"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90576528430296898120755490839063719107",
                "13027975485036815474581773685085882560",
                "126913561542467685848385736748660379963",
                "120057232960386013091213767865018100052",
                "238338875974929402903077651340709672099",
                "311301394149501092745153122744682749633",
                "228965067231896681918472954064306286915",
                "198784288787506767673547262127702695870",
                "116896362773117968986992054566983355637",
                "54812592086934502410400393362044132628",
                "275396659453168146846474765379251851208",
                "339898938813356912215474065164184330416",
                "92421259131615517123136341685250285709",
                "24088320557047686860237902668735529648",
                "143425457230523023327637320422470416433",
                "184116485746005907634812850471436043185",
                "244787488993685211401930645710775873220",
                "13462835831282496007764312541256958902",
                "83440543039140307660691959007886267674",
                "174869858338788699499117222772757980168",
                "202737803837628621120433277460918876468",
                "328185958452584331014230281185948690170",
                "240093956067499058444710261987957997040",
                "88252559813579453762325993272415386278",
                "203032639887099577378365686407674745722",
                "129496264638975317847799490315622292969"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-50022-7ca1dfda",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/nceas/metacat/commit/d500306188881d768b93f189bb8ddbf090f3f1ec",
        "target": {
            "file": "src/edu/ucsb/nceas/metacat/index/MetacatSolrIndex.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "131944655466971769593281580800217479342",
            "length": 411
        },
        "id": "CVE-2026-50022-a08d8575",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/nceas/metacat/commit/d500306188881d768b93f189bb8ddbf090f3f1ec",
        "target": {
            "file": "src/edu/ucsb/nceas/metacat/index/MetacatSolrIndex.java",
            "function": "query"
        }
    }
]
vanir_signatures_modified 
"2026-09-19T08:14:25Z"