CVE-2026-49498: Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username
Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in PasswordChange network messages to escalate to PostgreSQL superuser privileges and gain full database control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.1 - Configuration
Disable processing of PasswordChange network messages (or otherwise disable remote password-change functionality) until Ghidra is upgraded to 12.1.
Ghidra PasswordChange network messages handling = disabled - Compensating control
Restrict network access to the Ghidra service that handles PasswordChange messages (e.g., firewall allowlist, network ACLs, or isolate the instance) so only trusted management hosts can send these messages.
- Operational
If exploitation is suspected, assume PostgreSQL superuser compromise: rotate PostgreSQL superuser and other database credentials, and perform a full audit of the database for unauthorized changes.
Event History
Frequently Asked Questions
What is CVE-2026-49498?
CVE-2026-49498 is a SQL injection vulnerability in Ghidra 11.0 that affects the password change functionality due to unescaped usernames.
What is the severity of CVE-2026-49498?
The severity of CVE-2026-49498 is rated as high with a score of 8.7.
How do I fix CVE-2026-49498?
To fix CVE-2026-49498, update Ghidra to version 12.1 or later.
Who is affected by CVE-2026-49498?
Authenticated users of Ghidra 11.0 prior to 12.1 who attempt to change passwords are affected by CVE-2026-49498.
What could an attacker do with CVE-2026-49498?
An attacker can exploit CVE-2026-49498 to inject and execute arbitrary SQL commands in the database using crafted username parameters.