CVE-2026-61781: critical vulnerability in pgpartman pg_partman
pg_partman has privilege escalation through SQL injection in create_partition_time()
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 0.8%
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
pgpartman · pg_partmanRelated CVEs — pgpartman pg_partman
In the same product, most dangerous first.
CVE-2026-61819HIGHpg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exceptionEPSS 0.7%CVE-2026-61820HIGHpg_partman privilege escalation via SQL injection when inheriting template propertiesEPSS 0.7%CVE-2026-61817HIGHpg_partman privilege escalation via SQL injection in several functions via time decoderEPSS 0.7%CVE-2026-61822MEDIUMpg_partman disable maintenance for all partition setsEPSS 0.5%CVE-2026-61818HIGHpg_partman SQL injection in undo partition time encoderEPSS 0.5%CVE-2026-61821HIGHpg_partman authorization bypass to move child tables between schemas during retentionEPSS 0.4%