CVE-2026-61820: falha de alta gravidade em pgpartman pg_partman
pg_partman privilege escalation via SQL injection when inheriting template properties
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.7%
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
pgpartman · pg_partmanCVEs relacionadas — pgpartman pg_partman
No mesmo produto, das mais perigosas para as menos.
CVE-2026-61781CRITICALpg_partman has privilege escalation through SQL injection in create_partition_time()EPSS 0.8%CVE-2026-61819HIGHpg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exceptionEPSS 0.7%CVE-2026-61817HIGHpg_partman privilege escalation via SQL injection in several functions via time decoderEPSS 0.7%CVE-2026-61822MEDIUMpg_partman disable maintenance for all partition setsEPSS 0.5%CVE-2026-61818HIGHpg_partman SQL injection in undo partition time encoderEPSS 0.5%CVE-2026-61821HIGHpg_partman authorization bypass to move child tables between schemas during retentionEPSS 0.4%