CVE-2026-61819: falha de alta gravidade em pgpartman pg_partman
pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.7%
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the literal and injects SQL when an affected exception path runs. If pg_partman_bgw reaches that path, the injected SQL executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The persistent part_config row can trigger the escalation again on later maintenance ticks. This issue is fixed in version 5.5.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
pgpartman · pg_partmanCVEs relacionadas — pgpartman pg_partman
No mesmo produto, das mais perigosas para as menos.
CVE-2026-61781CRITICALpg_partman has privilege escalation through SQL injection in create_partition_time()EPSS 0.8%CVE-2026-61820HIGHpg_partman privilege escalation via SQL injection when inheriting template propertiesEPSS 0.7%CVE-2026-61817HIGHpg_partman privilege escalation via SQL injection in several functions via time decoderEPSS 0.7%CVE-2026-61822MEDIUMpg_partman disable maintenance for all partition setsEPSS 0.5%CVE-2026-61818HIGHpg_partman SQL injection in undo partition time encoderEPSS 0.5%CVE-2026-61821HIGHpg_partman authorization bypass to move child tables between schemas during retentionEPSS 0.4%