CVE-2026-49498Disclosure(nsa / ghidra)

LOWCVSS 8.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in PasswordChange network messages to escalate to PostgreSQL superuser privileges and gain full database control.

nsa CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ghidra

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Affected systems

Vendors

nsa

Products

ghidra

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew138d
Disclosure
CVE-2026-49498 Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in userna… https://www.cve.org/CVERecord?id=CVE-2026-49498
Post summary
The post reports a newly identified SQL injection vulnerability in Ghidra’s PostgresFunctionDatabase changePassword method, providing technical details but no PoC, exploit, patch, or evidence of active exploitation.
00010130
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds138d
General
CVE-2026-49498 SQL Injection in Ghidra PostgresFunctionDatabase changePassword() Method Before 12.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49498
Post summary
The text provides a concise mention of a SQL Injection vulnerability in Ghidra before version 12.1, with no additional PoC, exploit code, active exploitation, patch, or debunking details.
0000045
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nsa	ghidra	-	-	-

Explore more

Back to dashboard nsa CVEs ghidra vulnerabilities