EUVD-2026-36007Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-privileged Ghidra credentials
-
DeliveryConnect to Ghidra server over network
-
ExploitSend PasswordChange message with double-quoted username payload
-
InstallBreak out of ALTER ROLE identifier quoting
-
C2Execute injected SQL granting SUPERUSER
-
ExecuteTake full control of PostgreSQL backend
-
ImpactExfiltrate or tamper with shared project data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a Ghidra server deployment configured to use the PostgreSQL-backed PostgresFunctionDatabase for multi-user collaboration (not the default standalone or file-based project mode), running an affected version in the 11.0 through pre-12.1 range. The attacker must hold valid authenticated credentials on the Ghidra server (CVSS PR:L) and be able to reach it over the network to send a PasswordChange message, but no user interaction (UI:N) and no elevated privileges (AT:N) are required. Exploitation is limited where the Ghidra server is network-isolated, where PostgreSQL is not used as the backing store, or where the Ghidra-to-PostgreSQL service account itself lacks the ability to grant elevated roles. |
| Impact | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N, with high impact to confidentiality, integrity, and availability of the vulnerable component) reflects a network-reachable, low-complexity flaw requiring only low-privileged authentication and no user interaction - credible signals for a serious server-side issue. There is no EPSS score, KEV listing, or SSVC decision data in the provided inputs, and no public exploit code has been identified at time of analysis, so this should be treated as a high-severity latent risk rather than a confirmed mass-exploitation threat. The scope is somewhat narrowed by the prerequisite that an organization run Ghidra's PostgreSQL-backed shared server (not the default standalone configuration) and that the attacker already hold valid Ghidra credentials, but the payoff - full PostgreSQL superuser control over the shared reverse-engineering database - is severe enough that any team operating a Ghidra server should treat it as priority remediation. |
| Exploit ScenarioDerived | An attacker with a low-privileged Ghidra user account on a shared PostgreSQL-backed Ghidra server sends a crafted PasswordChange network message containing double quotes and appended SQL inside the username field. The malicious payload escapes the ALTER ROLE identifier context and executes attacker-chosen SQL - for example granting their own role SUPERUSER - yielding full control over the PostgreSQL instance backing the team's reverse-engineering projects, including the ability to exfiltrate or tamper with all shared analysis data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 10, 2026
SQL injection in Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) allows authenticated users to escalate to PostgreSQL superuser by injecting crafted username strings into ALTER ROLE statements issued by the changePassword() method. Exploitation requires only low-privileged authenticated access to the Ghidra server, and no public exploit has been identified at time of analysis despite a working proof-of-concept being implied by the detailed vendor advisory from VulnCheck and NSA.
Earlier versions of this analysis (2)
SQL injection in Ghidra's PostgreSQL-backed shared project server (versions 11.0 through 12.0) allows authenticated users to escalate to PostgreSQL superuser by injecting crafted usernames into ALTER ROLE statements during password changes. The flaw was disclosed by VulnCheck with a vendor security advisory (GHSA-vv7r-2rhf-5h7g), and no public exploit identified at time of analysis, but CVSS 4.0 scores the issue 8.7 (High) reflecting low-complexity network-reachable abuse by any valid project user.
Privilege escalation in NSA Ghidra versions 11.0 through 12.0 allows authenticated users to gain PostgreSQL superuser access via SQL injection in the PostgresFunctionDatabase.changePassword() method, which fails to escape double quotes in usernames embedded into ALTER ROLE statements. Reported by VulnCheck and tracked in GitHub advisory GHSA-vv7r-2rhf-5h7g, the flaw is exploitable over the network by any user with valid credentials by sending crafted PasswordChange messages. No public exploit identified at time of analysis, but the issue requires only low privileges and no user interaction, making it a meaningful risk for Ghidra Server deployments with shared PostgreSQL backends.
RemediationAI
Vendor-released patch: upgrade Ghidra to version 12.1 or later, which fixes the username escaping in the PostgresFunctionDatabase changePassword() routine; release artifacts and details are linked from the GHSA advisory at https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vv7r-2rhf-5h7g and the VulnCheck advisory at https://www.vulncheck.com/advisories/ghidra-sql-injection-in-postgresql-password-change-via-unescaped-username. Until patching is feasible, restrict Ghidra server access to a trusted network segment or VPN to limit who can submit PasswordChange messages, audit and tightly scope the Ghidra-to-PostgreSQL service account so it does not already hold superuser rights (reducing what an attacker can immediately do), rotate any credentials that may have been exposed, and consider temporarily disabling the shared PostgreSQL backend in favor of the file-based project repository if collaboration can be paused - accepting the trade-off of losing concurrent multi-user editing until the upgrade is complete.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ghidra is the NSA's open-source software reverse-engineering suite, which includes a multi-user server backend that can use PostgreSQL to store shared function databases (PostgresFunctionDatabase). The vulnerability sits in the changePassword() method, which constructs ALTER ROLE SQL statements by directly interpolating the username from a client-supplied PasswordChange network message. Because the routine escapes single quotes but fails to escape double quotes - the delimiter PostgreSQL uses for quoted identifiers - an attacker can break out of the identifier context and append arbitrary SQL. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically the identifier-quoting variant that is often missed when developers only sanitize string literals.
Know when Ghidra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in PasswordChange network messages to escalate to PostgreSQL superuser privileges and gain full database control.
Articles & Coverage 2
Executive ViewAI
Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) contains a SQL injection vulnerability allowing privilege escalation to database superuser, exposing sensitive reverse engineering data and team collaboration artifacts. Organizations operating collaborative reverse engineering or malware analysis teams using Ghidra face risk of unauthorized access to proprietary security research. No vendor patch is currently available, requiring immediate deployment of network segmentation and access controls.
Network segmentation isolating PostgreSQL backends; enforce least-privilege database accounts without superuser access; real-time logging and alerting for ALTER ROLE commands and privilege escalation; restrict collaboration feature access to authorized internal users; disable remote PostgreSQL access from untrusted networks; upgrade to Ghidra 12.1 or later when released to apply vendor fix, as versions 12.1+ are not affected by this vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files featu
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a pro
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. Ra
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive)
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously
SQL injection in Ghidra's BSim binary-similarity component (versions before 12.1) allows authenticated remote attackers
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to imperso
Remote code execution in NSA Ghidra before version 12.1 allows attackers to execute arbitrary commands when a user opens
Command injection in Ghidra versions before 12.1 on Windows allows attackers to execute arbitrary OS commands under the
Arbitrary file write in NSA's Ghidra reverse-engineering framework before version 12.0.4 allows attackers to escape the
Arbitrary file write in NSA Ghidra versions prior to 12.0.2 allows local attackers to achieve code execution by tricking
Exploit-DB