CVE-2026-61818: pg_partman SQL injection in undo partition time encoder
pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undopartition() reads partconfig.timeencoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partmanuser access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undopartition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pg_partmanto a version that resolves this vulnerability.Fixed in 5.5.0
Event History
Frequently Asked Questions
Who can exploit this issue, and whose privileges are used for the injected SQL?
A role with partman_user access can place SQL in part_config.time_encoder. That SQL executes with the privileges of the caller that invokes undo_partition(), so impact depends on the permissions held by that caller.
Is the default pg_partman background-worker workflow affected?
No. undo_partition() is not part of the default background-worker path, limiting automatic superuser escalation through that path.
Which deployments should be prioritized for remediation?
Prioritize deployments where partman_user-access roles can modify time_encoder values and where more privileged roles invoke undo_partition(). Those privileged callers may have their confidentiality, integrity, and availability permissions abused.
What version fixes the issue?
The issue is fixed in pg_partman version 5.5.0.