CVE-2026-49498 is a SQL injection vulnerability in Ghidra's PostgresFunctionDatabase component affecting versions 11.0 through before 12.1. The vulnerability occurs because the changePassword() method fails to properly escape double quotes in usernames interpolated into ALTER ROLE SQL commands. This allows authenticated attackers to craft malicious username parameters in PasswordChange network messages to execute arbitrary SQL commands. Successful exploitation can escalate privileges to PostgreSQL superuser level, granting full database control.

An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands with elevated privileges, specifically escalating to PostgreSQL superuser rights. This results in full control over the underlying database, which can lead to data manipulation, unauthorized access, and potential compromise of the entire Ghidra application environment relying on that database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the PasswordChange functionality to trusted users only and monitor for suspicious activity related to password changes. Avoid using vulnerable versions in sensitive environments.