SQL Injection Vulnerability in pg_partman PostgreSQL Extension

CVE-2026-61820

What is CVE-2026-61820?

The pg_partman extension, which facilitates management of partitioned tables in PostgreSQL, contains a vulnerability in prior versions leading up to 5.5.0. The flaw resides in the inherit_template_properties() function, where primary-key column names are improperly quoted. An attacker with access to create template tables can exploit this oversight by crafting column names that disrupt the generation of ALTER TABLE commands. This can lead to code executing with the default role privileges of a PostgreSQL superuser, potentially compromising the entire database and allowing for execution of operating system commands with the privileges of the PostgreSQL service account. The vulnerability can persist and trigger during future partition creations, making it critical for users to upgrade to version 5.5.0 or later to mitigate these risks.

References