CVE-2026-49498 Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username

What is CVE-2026-49498?

CVE-2026-49498 is a high-severity SQL injection vulnerability in nationalsecurityagency ghidra, published on 10 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in PasswordChange network messages to escalate to PostgreSQL superuser privileges and gain full database control.

Weakness: CWE-89

Which versions are affected by CVE-2026-49498?

It affects 1 product.

Products include Nsa Ghidra.

How do I fix CVE-2026-49498?

No fix has been published for CVE-2026-49498 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-49498 being exploited?

There is no known exploitation of CVE-2026-49498 in the wild and no public exploit code.

Other vulnerabilities in nationalsecurityagency ghidra

• CVE-2023-22671 Command injection in n/a Critical 9.8
• CVE-2019-16941 XML external entity in n/a Critical 9.8
• CVE-2019-13625 XML external entity in n/a Critical 9.1
• CVE-2026-4946 NSA Ghidra Auto-Analysis Annotation Command Execution High 8.8
• CVE-2026-52754 Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vv7r-2rhf-5h7g.