CVE-2026-49498: Ghidra PostgreSQL SQL Injection – Privilege Escalation Vulnerability

Technical summary

The vulnerability exists in the changePassword() method of PostgresFunctionDatabase, where user-supplied usernames are interpolated directly into ALTER ROLE SQL statements without proper escaping of double-quote characters. An attacker with valid Ghidra credentials can craft a PasswordChange network message containing a specially formatted username that breaks out of the intended SQL context and injects arbitrary commands. The unescaped double quotes allow the attacker to close the username string prematurely and append malicious SQL, such as granting superuser privileges to their own role. This is a classic SQL injection scenario (CWE-89) enabled by insufficient input sanitization in a database abstraction layer.

Business impact

Successful exploitation grants an authenticated attacker complete control over the PostgreSQL database backend used by Ghidra. This includes the ability to read, modify, or delete any data stored in that database, create new superuser accounts for persistence, and potentially pivot to other systems that depend on the database. For organizations using Ghidra in security-sensitive contexts (reverse engineering, vulnerability analysis, incident response), database compromise exposes analysis projects, metadata, and collaboration records. The attack requires valid Ghidra credentials but can escalate a regular user's privilege far beyond their intended scope.

Affected systems

NSA Ghidra versions 11.0 through 12.0 (inclusive) are affected when configured to use PostgreSQL as the backend database for collaborative or multi-user deployments. Single-user Ghidra installations that do not use PostgreSQL are not vulnerable. Standalone Ghidra instances using the embedded database are also not affected. The vulnerability is specific to the PostgresFunctionDatabase component, so deployments relying on other database backends do not face this particular risk.

Exploitability

Exploitation requires valid Ghidra credentials and network access to the PostgreSQL database layer. The attack is straightforward to execute: an authenticated user simply modifies the username field in a PasswordChange message with a crafted payload containing unescaped double quotes and SQL injection syntax. No complex multi-stage attack or race condition is necessary. The relatively low barrier to exploitation (valid credentials + straightforward injection) combined with the high impact (superuser database access) makes this a material risk for any multi-user Ghidra deployment. The CVSS 3.1 score of 8.8 reflects the high confidentiality, integrity, and availability impact, moderated only by the requirement for prior authentication.

Remediation

Upgrade Ghidra to version 12.1 or later, which properly escapes double quotes and other special characters in username parameters before constructing ALTER ROLE statements. Organizations unable to upgrade immediately should restrict network access to the PostgreSQL database to only trusted Ghidra application servers, implement database activity monitoring to detect unusual ALTER ROLE or privilege-escalation commands, and enforce strong authentication policies to reduce the number of valid accounts that could be compromised.

Patch guidance

NSA has released Ghidra 12.1 with a fix for this vulnerability. Update all affected Ghidra deployments to version 12.1 or later. Verify the patch by confirming the version number in Ghidra's About dialog or via the command line (ghidra_version command). Test the upgrade in a non-production environment first to ensure compatibility with existing databases and client configurations. Review release notes for any breaking changes or migration steps.

Detection guidance

Monitor PostgreSQL audit logs for unexpected ALTER ROLE statements, especially those granting superuser privileges or altering role attributes for accounts that should not have such permissions. Look for PasswordChange network messages containing usernames with unusual characters (double quotes, semicolons, SQL keywords) in Ghidra network traffic captures or application logs. Enable verbose logging in PostgresFunctionDatabase if available. Inspect database user accounts for unauthorized privilege escalations or new superuser roles created without administrative approval. Query the PostgreSQL system catalog (pg_roles) for unexpected role modifications.

Why prioritize this

This vulnerability merits high priority because it combines easy exploitability (for authenticated users) with severe impact (full database control). While it requires valid Ghidra credentials, insider threats, compromised accounts, or lateral movement from other breached systems can rapidly lead to database compromise. Any organization running multi-user Ghidra should treat this as a priority patch candidate, especially if the PostgreSQL backend stores sensitive reverse-engineering or security analysis data.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the high impact across confidentiality, integrity, and availability (all rated High in the vector). The attack vector is network-based, access complexity is low, and no user interaction is required beyond the attacker's own authentication. The primary mitigating factor is the requirement for prior valid credentials (PR:L), which prevents unauthenticated exploitation. Organizations with strong access controls and credential hygiene can reduce practical risk, but the intrinsic severity remains high.

Frequently asked questions