High severity · published Jun 10, 2026
CVE-2026-49498
Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in PasswordChange network messages to escalate to PostgreSQL superuser privileges and gain full database control.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GH
ghidra · nationalsecurityagency
11.0 before 12.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49498
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49498
Vendor Advisory
https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vv7r-2rhf-5h7g
Third Party Advisory
https://www.vulncheck.com/advisories/ghidra-sql-injection-in-postgresql-password-change-via-unescaped-username
More from ghidra
8.8
CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search
8.8
CVE-2026-52754
Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule
8.8
CVE-2026-52751
Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection
7.8
CVE-2026-52755
Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import
7.8
CVE-2026-52752
Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names