CVE-2026-61781: pg_partman has privilege escalation through SQL injection in create_partition_time()
pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, createpartitiontime() reads the writable partconfig.timeencoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partmanuser INSERT and UPDATE privileges can store SQL rather than a function name. When pgpartmanbgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pgpartmanbgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pg_partmanto a version that resolves this vulnerability.Fixed in 5.5.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using pg_partman before 5.5.0 are exposed when a text- or UUID-keyed partition set is maintained by pg_partman_bgw. The risk is greatest where the background worker runs with its default PostgreSQL superuser role.
What access does an attacker need to exploit this?
An attacker needs a role granted the documented partman_user INSERT and UPDATE privileges. They can write SQL into part_config.time_encoder, which is intended to contain a function name.
Is exploitation dependent on interactive timing or a separate privileged action?
No user interaction is required. When pg_partman_bgw subsequently creates a child partition, it executes the stored value using the worker's role privileges; the configuration can also persist and re-establish elevated access on later maintenance ticks.
What should be done if an immediate upgrade is not possible?
Restrict or remove partman_user INSERT and UPDATE access for untrusted roles, and inspect writable part_config.time_encoder values for unexpected SQL rather than expected function names. Also review the privileges assigned to pg_partman_bgw, since its default role is PostgreSQL superuser.
How can administrators determine whether compromise may already have occurred?
Review part_config records, especially time_encoder values for text- or UUID-keyed partition sets, for injected SQL. Because successful exploitation can lead to database-wide compromise and operating-system command execution as the PostgreSQL service account, suspicious values should be treated as evidence requiring broader database and host investigation.