CVE-2026-49498: Ghidra SQL Injection Vulnerability

CVE-2026-49498 Overview

CVE-2026-49498 is a SQL injection vulnerability [CWE-89] in the National Security Agency's Ghidra software reverse engineering framework. The flaw resides in the changePassword() method of PostgresFunctionDatabase in Ghidra versions 11.0 through 12.0. The method fails to escape double quotes in usernames before interpolating them into PostgreSQL ALTER ROLE statements. Authenticated attackers can inject SQL commands through crafted username parameters in PasswordChange network messages. Successful exploitation escalates the attacker to PostgreSQL superuser privileges and grants full database control.

Critical Impact
Authenticated attackers can achieve PostgreSQL superuser privileges through SQL injection in Ghidra's password change handler, resulting in full backend database compromise.

Affected Products

Ghidra 11.0 through 11.x (fixed in 12.1)
PostgresFunctionDatabase component
Ghidra shared project server deployments using PostgreSQL backend

Discovery Timeline

2026-06-10 - CVE-2026-49498 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-49498

Vulnerability Analysis

Ghidra supports collaborative reverse engineering through a server component that can store function metadata in a PostgreSQL database. The PostgresFunctionDatabase class manages user accounts within this backend. When a client sends a PasswordChange network message, the server invokes changePassword() to update credentials.

The changePassword() method constructs a SQL ALTER ROLE statement by interpolating the supplied username directly into the query text. The implementation escapes single quotes but does not escape double quotes. PostgreSQL uses double quotes to delimit identifiers, so a username containing a double quote terminates the identifier context and exposes the remainder of the statement to attacker control.

An authenticated user can submit a username crafted to break out of the identifier and append arbitrary SQL. This includes statements that grant SUPERUSER privileges to the attacker's account or modify other roles. Once superuser status is obtained, the attacker controls all data stored in the Ghidra project database.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The changePassword() method treats usernames as trusted input and performs only partial quote escaping. PostgreSQL identifier syntax requires escaping embedded double quotes by doubling them, which the code omits. Parameterized queries are not used for the identifier portion of the ALTER ROLE statement.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker needs an authenticated session on the Ghidra server to send a PasswordChange message. The malicious username payload terminates the quoted identifier, injects additional SQL, and comments out the trailing statement remnants. The injected SQL executes with the privileges of the PostgreSQL role used by Ghidra's database connection, which typically permits role modification.

No verified exploit code is publicly available. Refer to the GitHub Security Advisory and the VulnCheck Advisory for technical details on the injection mechanism.

Detection Methods for CVE-2026-49498

Indicators of Compromise

PostgreSQL audit log entries showing ALTER ROLE statements containing unexpected double quote sequences or appended SQL clauses
Sudden privilege changes on PostgreSQL roles, particularly accounts gaining SUPERUSER attribute outside scheduled administrative activity
PasswordChange network messages on the Ghidra server containing non-standard characters such as " in the username field

Detection Strategies

Enable PostgreSQL statement logging (log_statement = 'ddl') and alert on ALTER ROLE statements that include unusual identifier patterns
Inspect Ghidra server logs for PasswordChange requests originating from low-privilege accounts targeting other usernames
Correlate authentication events with subsequent database privilege changes to identify lateral escalation

Monitoring Recommendations

Forward PostgreSQL and Ghidra server logs to a centralized SIEM for retention and correlation
Baseline normal ALTER ROLE activity and alert on deviations such as off-hours execution or unexpected source accounts
Track changes to the pg_roles catalog to detect unauthorized superuser grants

How to Mitigate CVE-2026-49498

Immediate Actions Required

Upgrade Ghidra to version 12.1 or later on all servers running the PostgreSQL function database backend
Audit existing PostgreSQL roles for unauthorized SUPERUSER assignments and revoke any that cannot be justified
Rotate credentials for the Ghidra database service account and for any user accounts that may have been compromised

Patch Information

The National Security Agency released a fix in Ghidra 12.1 that properly escapes double quotes in usernames before interpolation into ALTER ROLE statements. Details are available in the GitHub Security Advisory GHSA-vv7r-2rhf-5h7g.

Workarounds

Restrict Ghidra server access to trusted networks and authenticated users only, reducing the pool of accounts that can send PasswordChange messages
Configure the PostgreSQL role used by Ghidra with the minimum privileges required, avoiding membership in roles that can grant SUPERUSER
Enforce username policies on the Ghidra server that reject characters such as " until the patch is applied

bash

# Verify Ghidra server version and identify hosts requiring patch
ghidraRun --version

# Audit PostgreSQL for unauthorized superuser roles
psql -U postgres -c "SELECT rolname, rolsuper FROM pg_roles WHERE rolsuper = true;"