CVE-2026-61821: falha de alta gravidade em pgpartman pg_partman
pg_partman authorization bypass to move child tables between schemas during retention
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.4%
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Produtos afetados
pgpartman · pg_partmanCVEs relacionadas — pgpartman pg_partman
No mesmo produto, das mais perigosas para as menos.
CVE-2026-61781CRITICALpg_partman has privilege escalation through SQL injection in create_partition_time()EPSS 0.8%CVE-2026-61819HIGHpg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exceptionEPSS 0.7%CVE-2026-61820HIGHpg_partman privilege escalation via SQL injection when inheriting template propertiesEPSS 0.7%CVE-2026-61817HIGHpg_partman privilege escalation via SQL injection in several functions via time decoderEPSS 0.7%CVE-2026-61822MEDIUMpg_partman disable maintenance for all partition setsEPSS 0.5%CVE-2026-61818HIGHpg_partman SQL injection in undo partition time encoderEPSS 0.5%