CVE-2026-50022

Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An unauthenticated client can select the /admin/file handler, and SolrJ reformats the parameter into a request accepted even when handleSelect=false is configured on Solr 7.0 or later. When Solr returns the selected core configuration file, Metacat embeds the raw content in an XML processing error response, disclosing internal files such as solrconfig.xml and enabling infrastructure profiling. This issue is fixed in version 3.4.2.

• CWE-441

• https://github.com/NCEAS/metacat/commit/d500306188881d768b93f189bb8ddbf090f3f1ec
• https://github.com/NCEAS/metacat/pull/2319
• https://github.com/NCEAS/metacat/releases/tag/3.4.2
• https://github.com/NCEAS/metacat/security/advisories/GHSA-57g5-qq6w-7jr8

Published

Sep 17, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50017pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…6.5
• CVE-2026-50018Hoverfly is an open source API simulation tool. Prior to ver…6.5
• CVE-2026-50019yt-dlp is a command-line audio/video downloader. From 2023.0…7.4
• CVE-2026-5002A vulnerability has been found in PromtEngineer localGPT up …7.3
• CVE-2026-50020Netty is a network application framework for development of …5.3
• CVE-2026-50021pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…8.1
• CVE-2026-50023yt-dlp is a command-line audio/video downloader. Prior to 20…9.6
• CVE-2026-50024GitHacker is a tool that restores Git repositories from expo…5.3
• CVE-2026-50025Mousehole is a background service to update a seedbox IP for…6.9
• CVE-2026-50026Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-50027mcp-memory-service is a semantic memory layer for AI applica…9.8
• CVE-2026-50029js-toml is a TOML parser for JavaScript, Prior to version 1.…5.3