High severity8.8NVD Advisory· Published Jun 10, 2026· Updated Jun 11, 2026

CVE-2026-49498

Description

Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in PasswordChange network messages to escalate to PostgreSQL superuser privileges and gain full database control.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nationalsecurityagency/Ghidra2 versions
cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*range: >=11.0,<12.1
- (no CPE)range: >=11.0, <12.1

Patches

Vulnerability mechanics

References

github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vv7r-2rhf-5h7gnvdVendor Advisory
www.vulncheck.com/advisories/ghidra-sql-injection-in-postgresql-password-change-via-unescaped-usernamenvdThird Party Advisory

News mentions

National Security Agency's Ghidra: 15 Vulnerabilities Disclosed on June 10, 2026
Vypr Intelligence · Jun 10, 2026

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000