# CVE-2026-49498: NSA Ghidra SQL injection in BSim PostgresFunctionDatabase

Source: https://junglewise.ai/threats/cve-2026-49498-nsa-ghidra-sql-injection-in-bsim-postgresfunctiondatabase  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-49498 · Severity: high · CVSS 8.8 · Published 2026-06-10

Ghidra is a software reverse engineering suite used by security researchers and developers. A vulnerability in its BSim component allows a user with basic database access to execute unauthorized commands on the underlying PostgreSQL server. This could lead to a total takeover of the database, allowing an attacker to steal sensitive research data, modify system configurations, or potentially gain control of the host operating system.

Technologies: [National Security Agency Ghidra](https://junglewise.ai/threats/technologies/ghidra). Vendors: [National Security Agency](https://junglewise.ai/threats/vendors/national-security-agency).

## Quick answers

**Is CVE-2026-49498 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49498 being exploited in the wild.

**How severe is CVE-2026-49498?** High severity, with a CVSS score of 8.8, published 10 June 2026.

**Which products and versions are affected?** National Security Agency Ghidra 11.0 to 12.0.x.

**Is there a fix for CVE-2026-49498?** A patch was published on 2026-06-10: Vulnerability addressed in version 12.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49498 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49498?** Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the `changePassword()` method of the `PostgresFunctionDatabase` class within Ghidra's BSim feature. The application fails to escape double quotes in usernames before interpolating them into `ALTER ROLE` SQL statements. An authenticated attacker can send a crafted `PasswordChange` network message containing a malicious username to break out of the quoted identifier. This allows the execution of arbitrary SQL commands with the privileges of the database service, leading to PostgreSQL superuser escalation and potential remote code execution via PostgreSQL features like `COPY PROGRAM`. The issue is fixed in Ghidra version 12.1.

## Affected products

- NSA Ghidra 11.0 to 12.0.x

## Timeline

- 2026-05-14: advisory: Initial GitHub Security Advisory published by NSA
- 2026-06-10: disclosed: CVE-2026-49498 published and added to NVD
- 2026-06-10: patched: Vulnerability addressed in version 12.1

## References

- [https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vv7r-2rhf-5h7g](https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vv7r-2rhf-5h7g)
- [https://www.vulncheck.com/advisories/ghidra-sql-injection-in-postgresql-password-change-via-unescaped-username](https://www.vulncheck.com/advisories/ghidra-sql-injection-in-postgresql-password-change-via-unescaped-username)

## Related threats

- [Ghidra zip bomb in extension extraction](https://junglewise.ai/threats/cve-2026-115503-ghidra-before-12-2-contains-an-improper-handling-of-highly)
- [Ghidra resource allocation without limits in extension extraction](https://junglewise.ai/threats/cve-2026-115397-ghidra-before-12-2-contains-a-resource-allocation-without-limits)
- [Ghidra zip bomb vulnerability in theme import](https://junglewise.ai/threats/cve-2026-115396-ghidra-10-3-before-12-2-contains-an-improper-handling-of-highly)
- [Ghidra resource exhaustion in theme ZIP extraction](https://junglewise.ai/threats/cve-2026-115395-ghidra-10-3-before-12-2-contains-a-resource-allocation-without)
- [National Security Agency Ghidra heap out-of-bounds read in StringManager](https://junglewise.ai/threats/cve-2026-100505-ghidra-versions-11-2-through-12-1-4-contain-a-heap-out-of-bounds)