Is CVE-2026-52754 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52754 being exploited in the wild.

How severe is CVE-2026-52754?

High severity, with a CVSS score of 8.8, published 10 June 2026.

Which products and versions are affected?

National Security Agency Ghidra Server < 12.1.

Is there a fix for CVE-2026-52754?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52754 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-52754?

Check whether you run National Security Agency Ghidra Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52754: NSA Ghidra Server authentication bypass in PKIAuthenticationModule

Q: Is there a fix for CVE-2026-52754?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-52754 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-52754?

Check whether you run National Security Agency Ghidra Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52754 · Severity: high · CVSS 8.8 · Published 2026-06-10

Ghidra is a software reverse engineering suite used by security researchers to analyze code. A vulnerability in its server component allows a user with a valid digital certificate to impersonate any other user, including administrators, without knowing their password or private key. This could allow an attacker to steal sensitive research data, delete shared project databases, or take full control of the server's access settings.

Vendors: National Security Agency.

Quick answers

Is CVE-2026-52754 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52754 being exploited in the wild.
How severe is CVE-2026-52754?: High severity, with a CVSS score of 8.8, published 10 June 2026.
Which products and versions are affected?: National Security Agency Ghidra Server < 12.1.
Is there a fix for CVE-2026-52754?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52754 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-52754?: Check whether you run National Security Agency Ghidra Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in GhidraServer's PKIAuthenticationModule.authenticate() due to improper verification of cryptographic signatures (CWE-347). When the server is configured in PKI mode (-a2), it uses a challenge-response protocol where the client is expected to sign a random token. However, the server-side logic skips the signature verification block entirely if the signature bytes provided by the client are null, rather than rejecting the request. An attacker with a valid CA-signed certificate can present any other user's public certificate and a null signature to successfully authenticate as that user. This allows for privilege escalation to administrator status and full access to shared repositories. The issue is fixed in Ghidra version 12.1.

Affected products

National Security Agency (NSA) Ghidra Server < 12.1

Timeline

2019-03-26: other: Vulnerability introduced in initial open-source release
2026-05-14: advisory: GitHub Security Advisory GHSA-5wxq-7qpv-65p2 published
2026-06-10: disclosed: CVE-2026-52754 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.