Read the docs
TI-2026-44243 Aliases CVE-2026-61818

pg_partman SQL injection in undo partition time encoder

Priority LOW 39CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00513 43rd percentileScored 2026-11-07
Fix Fixed pg_partman (pgpartman): 5.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pgpartmanpg_partmanbefore 5.5.05.5.0Patch availableCNA
  • pg_partman Vendorpgpartman Affected before 5.5.0 Fixed in 5.5.0 Patch available CNA

Remediation

  • Fix · CNA pg_partman (pgpartman) Fixed in 5.5.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61818
  2. 2026-10-31 CVSS score changed · Red Hat

References

Other 3

  • TI-2026-44224 pg_partman has privilege escalation through SQL injection in create_partition_time() CVSS 3.1CRITICAL 9.9
  • TI-2026-44245 pg_partman privilege escalation via SQL injection when inheriting template properties CVSS 3.1HIGH 8.5
  • TI-2026-44244 pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception CVSS 3.1HIGH 8.5
  • TI-2026-44242 pg_partman privilege escalation via SQL injection in several functions via time decoder CVSS 3.1HIGH 8.5
  • TI-2026-44246 pg_partman authorization bypass to move child tables between schemas during retention CVSS 3.1HIGH 8.5
  • TI-2026-44247 pg_partman disable maintenance for all partition sets CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences