Vulnerability Description
Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in PasswordChange network messages to escalate to PostgreSQL superuser privileges and gain full database control.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nsa | Ghidra | >= 11.0, < 12.1 |
Related Weaknesses (CWE)
References
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vv7r-2Vendor Advisory
- https://www.vulncheck.com/advisories/ghidra-sql-injection-in-postgresql-passwordThird Party Advisory
FAQ
What is CVE-2026-49498?
CVE-2026-49498 is a vulnerability with a CVSS score of 8.8 (HIGH). Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE s...
How severe is CVE-2026-49498?
CVE-2026-49498 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49498?
Check the references section above for vendor advisories and patch information. Affected products include: Nsa Ghidra.