CVE-2026-49498: Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username

Synopsis

SQL injection in Ghidra's PostgresFunctionDatabase component affects versions 11.0 through 12.1. An authenticated attacker reachable over the network can send a crafted PasswordChange message with a malicious username to inject arbitrary SQL into an ALTER ROLE statement. Successful exploitation gives the attacker full PostgreSQL superuser privileges and complete database control. A patched-image rebuild at version 12.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Ghidra server over the network to deliver a crafted PasswordChange message.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient; no administrative credentials are needed to trigger the injection.

• Victim interactionNot required

  The attack is fully server-side and requires no action from another user.

• Attack complexityDetail

  Exploit is reliable and condition-free; no race conditions or specific memory layout are required.

Blast Radius

• Attacker escalates the database role to PostgreSQL superuser, gaining unrestricted control over all databases on the instance.
• Attacker reads all stored data, including credentials, analysis results, and any other records held in the Ghidra PostgreSQL backend.
• Attacker modifies or deletes persisted database rows, corrupting analysis data or covering tracks.
• Attacker crashes or degrades the database service, making the Ghidra collaborative environment unavailable.