SQL injection in Ghidra - CVE-2026-49498
Published: May 15, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU131579
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49498
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to SQL injection in changePassword() in PostgresFunctionDatabase when processing a PasswordChange network protocol message. A remote user can send a specially crafted username value to escalate privileges.
The issue arises because double quote characters in the username are not escaped before the value is interpolated into an ALTER ROLE SQL statement.
Affected software
Ghidra
How to mitigate CVE-2026-49498
Install security update from vendor's website.
Ghidra - update to 12.1