Read the docs
TI-2026-44242 Aliases CVE-2026-61817

pg_partman privilege escalation via SQL injection in several functions via time decoder

Priority MEDIUM 40CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder function name. When an affected operation later uses the poisoned value, including pg_partman_bgw maintenance for a text- or UUID-keyed set, the SQL executes with the operation's privileges, which can be the default PostgreSQL superuser background-worker role. The persistent row can restore elevated access on later ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00729 54th percentileScored 2026-11-07
Fix Fixed pg_partman (pgpartman): 5.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pgpartmanpg_partmanbefore 5.5.05.5.0Patch availableCNA
  • pg_partman Vendorpgpartman Affected before 5.5.0 Fixed in 5.5.0 Patch available CNA

Remediation

  • Fix · CNA pg_partman (pgpartman) Fixed in 5.5.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61817
  2. 2026-10-31 CVSS score changed · Red Hat

References

Other 3

  • TI-2026-44224 pg_partman has privilege escalation through SQL injection in create_partition_time() CVSS 3.1CRITICAL 9.9
  • TI-2026-44245 pg_partman privilege escalation via SQL injection when inheriting template properties CVSS 3.1HIGH 8.5
  • TI-2026-44244 pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception CVSS 3.1HIGH 8.5
  • TI-2026-44243 pg_partman SQL injection in undo partition time encoder CVSS 3.1HIGH 8.5
  • TI-2026-44246 pg_partman authorization bypass to move child tables between schemas during retention CVSS 3.1HIGH 8.5
  • TI-2026-44247 pg_partman disable maintenance for all partition sets CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences