Which versions of Ghidra are affected by CVE-2026-49498?

Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) contains a SQL injection vulnerability allowing privilege escalation to database superuser, exposing sensitive reverse…. A patch is available.

How to fix or mitigate CVE-2026-49498?

24 hours: Identify all Ghidra instances (versions 11.0 through pre-12.1) with PostgreSQL collaboration backends enabled; audit PostgreSQL logs for suspicious ALTER ROLE commands; no public exploit identified at time of analysis. 7 days: Implement network isolation of PostgreSQL backends from untrusted networks; apply principle-of-least-privilege database account configurations removing superuser access from application service accounts; disable remote PostgreSQL access. 30 days: Deploy real-time alerting on superuser privilege escalation and ALTER ROLE commands; develop upgrade readiness plan for Ghidra 12.1+ (when released); conduct security review of reverse engineering projects stored in collaborative instances.

Ghidra CVE-2026-49498

Q: What is the CVSS score of CVE-2026-49498?

CVE-2026-49498 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36007 HIGH

SQL Injection (CWE-89)

2026-06-10 VulnCheck

PostgreSQL SQLi Ghidra

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 15:01 EUVD

Analysis Updated

Jun 10, 2026 - 14:38 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 10, 2026 - 14:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 10, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jun 10, 2026 - 14:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 10, 2026 - 14:02 vuln.today

CVE Published

Jun 10, 2026 - 12:38 nvd

HIGH 8.8

DescriptionCVE.org

Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in PasswordChange network messages to escalate to PostgreSQL superuser privileges and gain full database control.

Articles & Coverage 2

News 4 New PostgreSQL Vulnerabilities - 2 Critical, 2 High Severity Jun 11, 2026 News 3 New PostgreSQL Vulnerabilities - 1 Critical, 2 High Severity Jun 10, 2026

AnalysisAI

SQL injection in Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) allows authenticated users to escalate to PostgreSQL superuser by injecting crafted username strings into ALTER ROLE statements issued by the changePassword() method. Exploitation requires only low-privileged authenticated access to the Ghidra server, and no public exploit has been identified at time of analysis despite a working proof-of-concept being implied by the detailed vendor advisory from VulnCheck and NSA.

Technical ContextAI

Ghidra is the NSA's open-source software reverse-engineering suite, which includes a multi-user server backend that can use PostgreSQL to store shared function databases (PostgresFunctionDatabase). The vulnerability sits in the changePassword() method, which constructs ALTER ROLE SQL statements by directly interpolating the username from a client-supplied PasswordChange network message. Because the routine escapes single quotes but fails to escape double quotes - the delimiter PostgreSQL uses for quoted identifiers - an attacker can break out of the identifier context and append arbitrary SQL. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically the identifier-quoting variant that is often missed when developers only sanitize string literals.

RemediationAI

Vendor-released patch: upgrade Ghidra to version 12.1 or later, which fixes the username escaping in the PostgresFunctionDatabase changePassword() routine; release artifacts and details are linked from the GHSA advisory at https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vv7r-2rhf-5h7g and the VulnCheck advisory at https://www.vulncheck.com/advisories/ghidra-sql-injection-in-postgresql-password-change-via-unescaped-username. Until patching is feasible, restrict Ghidra server access to a trusted network segment or VPN to limit who can submit PasswordChange messages, audit and tightly scope the Ghidra-to-PostgreSQL service account so it does not already hold superuser rights (reducing what an attacker can immediately do), rotate any credentials that may have been exposed, and consider temporarily disabling the shared PostgreSQL backend in favor of the file-based project repository if collaboration can be paused - accepting the trade-off of losing concurrent multi-user editing until the upgrade is complete.