SQL Injection Vulnerability in pg_partman PostgreSQL Extension

CVE-2026-61819

What is CVE-2026-61819?

The pg_partman PostgreSQL extension, which aids in managing partitioned tables, is susceptible to SQL Injection vulnerabilities when paired with pg_jobmon in configurations before version 5.5.0. If a partman_user has the ability to create a parent-table name that includes a single quote, it can result in the termination of a SQL string literal. This flaw allows the execution of injected SQL commands with the privileges of the pg_partman_bgw.role, which typically defaults to superuser access, enabling potential database compromise and command execution on the operating system as the PostgreSQL service account. The persistent nature of part_config ensures this could recur during subsequent maintenance tasks, exacerbating the risk. The issue has been addressed in pg_partman version 5.5.0.

References