Vulnerability · Published Jun 10, 2026 · Assigned by VulnCheck

CVE-2026-49498Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username

High 8.8

In plain English

A high-severity SQL injection in ghidra from nationalsecurityagency. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 82.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in PasswordChange network messages to escalate to PostgreSQL superuser privileges and gain full database control.

Affected products (as reported)

Vendor	Product	Versions
nationalsecurityagency	ghidra	11.0 – before 12.1

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-vv7r-2rhf-5h7g) vendor-advisory
https://www.vulncheck.com/advisories/ghidra-sql-injection-in-postgresql-password-change-via-unescaped-username third-party-advisory