PostgreSQL Extension Allows Privilege Escalation in pg_partman

CVE-2026-61818

What is CVE-2026-61818?

A vulnerability exists in pg_partman, a PostgreSQL extension designed to manage partitioned tables. Specifically, prior to version 5.5.0, the undo_partition() function inappropriately handles part_config.time_encoder by reading it as unrestricted text. This leads to SQL injection issues where a user with partman_user access can execute arbitrary SQL commands. The SQL is executed with the caller's privileges, risking the confidentiality, integrity, and availability across the database. While this vulnerability is limited in automatic escalation in the default background-worker path, it poses significant risks to privileged users. The issue has been addressed in version 5.5.0, and users are encouraged to upgrade to secure their databases.

References