PostgreSQL Extension Vulnerability in pg_partman by pg_partman

CVE-2026-61822

What is CVE-2026-61822?

The pg_partman extension for PostgreSQL, up to version 5.5.0, features an improper exception handling vulnerability in its run_maintenance() function. When managing partitioned tables, if an exception occurs during the processing of partition configurations, it causes the entire maintenance loop to terminate prematurely. This flaw enables an attacker with partman_user access to exploit the system by inserting or updating rows with low maintenance_order values, which can prevent legitimate partition sets from being processed. Consequently, automated maintenance for partitions can be disrupted, leading to potential data management issues across the database. Upgrade to version 5.5.0 or later for a resolution.

References