CVE-2026-61822: pg_partman disable maintenance for all partition sets
pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance() handles exceptions outside the loop that processes rows from partconfig, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partmanuser access can insert or update a row that reliably fails and assign it a low maintenanceorder value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pg_partmanto a version that resolves this vulnerability.Fixed in 5.5.0 - Configuration
Disable pg_partman automated maintenance for all partition sets (pg_partman disable maintenance for all partition sets) to prevent repeated maintenance ticks from aborting legitimate partition maintenance.
pg_partman maintenance for all partition sets = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
A role with partman_user access can exploit it by inserting or updating a part_config row that reliably raises an exception. The attacker can assign that row a low maintenance_order so it is handled before legitimate partition sets.
What is the operational impact of exploitation?
Each maintenance run can abort when it reaches the malicious or failing configuration row, skipping all later partition sets. Repeated runs can cause database-wide loss of automated partition maintenance for those skipped sets.
Which versions are affected and what is the fix?
pg_partman versions prior to 5.5.0 are affected. Upgrade to version 5.5.0, which changes exception handling so a failure for one partition set does not terminate processing of every later set.
How can administrators identify a possible exploit or exposure?
Review part_config entries that can be inserted or modified by roles with partman_user access, especially entries with unusually low maintenance_order values. Also investigate maintenance runs that terminate on an exception and consistently fail before later legitimate partition sets are processed.