CVE-2026-61817: pg_partman privilege escalation via SQL injection in several functions via time decoder
pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance(), showpartitions(), showpartitioninfo(), undopartition(), and partitiondatatime() interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role with the documented partmanuser privileges can store SQL rather than a decoder function name. When an affected operation later uses the poisoned value, including pgpartmanbgw maintenance for a text- or UUID-keyed set, the SQL executes with the operation's privileges, which can be the default PostgreSQL superuser background-worker role. The persistent row can restore elevated access on later ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pg_partmanto a version that resolves this vulnerability.Fixed in 5.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A role granted the documented partman_user privileges can exploit the issue by writing SQL into part_config.time_dncoder. Exploitation occurs later when an affected pg_partman operation uses that stored value.
Are default automated maintenance deployments affected?
They can be, particularly for text- or UUID-keyed partition sets handled by pg_partman_bgw. The background worker may run with the default PostgreSQL superuser role, causing injected SQL to execute with superuser privileges.
What can be done if upgrading is not immediately possible?
Restrict partman_user privileges to trusted roles, because those privileges allow writing the poisoned configuration value. Review part_config.time_dncoder for unexpected SQL rather than a decoder function name, and avoid running affected operations against untrusted configuration.
How can administrators check for possible compromise or persistence?
Inspect part_config.time_dncoder values for content that is not a legitimate decoder function name. A malicious stored value can be reused on later maintenance ticks and can restore elevated access after the initial execution.
What version resolves the issue?
Upgrade pg_partman to version 5.5.0, which fixes the unsafe interpolation of part_config.time_dncoder in the affected functions.