CVE-2026-49498 describes a SQL injection vulnerability in the National Security Agency's Ghidra software, specifically in versions 11.0 prior to 12.1. The vulnerability exists in the changePassword() method of the PostgresFunctionDatabase component, where double quotes in usernames are not properly escaped when interpolated into ALTER ROLE SQL commands. This allows an authenticated attacker to inject arbitrary SQL commands through crafted username parameters in PasswordChange network messages. Successful exploitation can lead to escalation to PostgreSQL superuser privileges, granting full database control. The CVSS 4.0 base score is 8.7, indicating high severity. No official patch or remediation guidance is currently provided, and no known exploits in the wild have been reported.

An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands with PostgreSQL superuser privileges. This can result in full compromise of the underlying database, including unauthorized data access, modification, or deletion, and potentially further system compromise through database control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the PasswordChange network messages to trusted users only and monitor for suspicious activity related to password changes. Avoid using affected versions in sensitive environments if possible.