Vulnerability in PostgreSQL Extension for Time-Based Partition Management by pg_partman

CVE-2026-61781

What is CVE-2026-61781?

The pg_partman extension for PostgreSQL is susceptible to a vulnerability that allows an attacker with INSERT and UPDATE privileges to execute arbitrary SQL commands. The issue arises in the create_partition_time() function, where user-controlled input is improperly handled, leading to the potential execution of malicious SQL under the role's privileges, which can default to superuser access. This could enable an attacker to achieve complete database compromise and potentially execute commands at the operating system level. The vulnerability has been addressed in version 5.5.0.

References