PostgreSQL Extension Vulnerability in pg_partman Managed by pg_partman Team

CVE-2026-61817

What is CVE-2026-61817?

pg_partman is a PostgreSQL extension used for managing partitioned tables effectively. In versions prior to 5.5.0, critical functions like run_maintenance() and show_partitions() inadequately handle the interpolation of the writable part_config.time_dncoder value into dynamic SQL without proper identifier quoting. This flaw allows a user with certain partman_user privileges to inject SQL commands instead of the expected decoder function name. When such an operation is executed, it can run with the privileges of the PostgreSQL superuser role, effectively compromising the security of the entire database. This vulnerability enables potential attackers to execute arbitrary commands within the operating system under the PostgreSQL service account. The issue has been addressed in version 5.5.0.

References