PT-2026-48409 · Postgresql Global Development Group+1 · Postgresql+1

Sean Nejad · Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-49498

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghidra versions 11.0 through 12.0

Description A SQL injection issue exists in the changePassword() function of the PostgresFunctionDatabase. The system fails to escape double quotes in usernames that are interpolated into ALTER ROLE statements. Authenticated attackers can exploit this by sending crafted username parameters within PasswordChange network messages to execute arbitrary SQL commands, allowing them to escalate privileges to PostgreSQL superuser and obtain full control of the database.

Recommendations Update to version 12.1. As a temporary workaround, restrict access to the changePassword() function within the PostgresFunctionDatabase to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-49498

Affected Products

Ghidra

Postgresql

References · 5

• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vv7r-2rhf-5h7g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49498 · Security Note
• https://twitter.com/VulmonFeeds/status/2064769145283981573 · Twitter Post
• https://vulncheck.com/advisories/ghidra-sql-injection-in-postgresql-password-change-via-unescaped-username · Note
• https://twitter.com/CVEnew/status/2064709820494610699 · Twitter Post