Read the docs
TI-2026-44224 Aliases CVE-2026-61781

pg_partman has privilege escalation through SQL injection in create_partition_time()

Priority MEDIUM 44CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269 and CWE-89.

Summary

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00804 56th percentileScored 2026-11-07
Fix Fixed pg_partman (pgpartman): 5.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pgpartmanpg_partmanbefore 5.5.05.5.0Patch availableCNA
  • pg_partman Vendorpgpartman Affected before 5.5.0 Fixed in 5.5.0 Patch available CNA

Remediation

  • Fix · CNA pg_partman (pgpartman) Fixed in 5.5.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61781

References

Other 3

  • TI-2026-44245 pg_partman privilege escalation via SQL injection when inheriting template properties CVSS 3.1HIGH 8.5
  • TI-2026-44244 pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception CVSS 3.1HIGH 8.5
  • TI-2026-44242 pg_partman privilege escalation via SQL injection in several functions via time decoder CVSS 3.1HIGH 8.5
  • TI-2026-44243 pg_partman SQL injection in undo partition time encoder CVSS 3.1HIGH 8.5
  • TI-2026-44246 pg_partman authorization bypass to move child tables between schemas during retention CVSS 3.1HIGH 8.5
  • TI-2026-44247 pg_partman disable maintenance for all partition sets CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences