PostgreSQL Extension Vulnerability in pg_partman Affects Database Management

CVE-2026-61821

What is CVE-2026-61821?

The pg_partman extension for PostgreSQL, used to manage partitioned tables, has a vulnerability in the functions drop_partition_id() and drop_partition_time(). Prior to version 5.5.0, these functions improperly leverage the part_config.retention_schema for ALTER TABLE SET SCHEMA without verifying appropriate permissions. As a result, a user with partman_user access can select target schemas for table relocation, even when lacking the usual CREATE privilege. This allows for unauthorized movement of internal child tables using the superuser privileges of the background worker, undermining the integrity of schema management. This vulnerability has been addressed in version 5.5.0.

References