GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    14 vulnerabilities by pgpartman

    CVE-2026-61822 (GCVE-0-2026-61822)

    Vulnerability from nvd – Published: 2026-09-18 19:45 – Updated: 2026-09-18 19:45
    VLAI
    Title
    pg_partman disable maintenance for all partition sets
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes rows from part_config, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    CWE
    • CWE-703 - Improper Check or Handling of Exceptional Conditions
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes rows from part_config, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-703",
              "description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:45:49.852Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-9m6c-hw23-c6h2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-9m6c-hw23-c6h2"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-9m6c-hw23-c6h2",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman disable maintenance for all partition sets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61822",
    "datePublished": "2026-09-18T19:45:49.852Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-18T19:45:49.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61821 (GCVE-0-2026-61821)

    Vulnerability from nvd – Published: 2026-09-18 19:46 – Updated: 2026-09-19 14:11
    VLAI
    Title
    pg_partman authorization bypass to move child tables between schemas during retention
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-19 13:37 UTC
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:37:30.159508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:11:36.998Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:46:41.985Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-pxp2-x8cf-rfhc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-pxp2-x8cf-rfhc"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-pxp2-x8cf-rfhc",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman authorization bypass to move child tables between schemas during retention"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61821",
    "datePublished": "2026-09-18T19:46:41.985Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-19T14:11:36.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61820 (GCVE-0-2026-61820)

    Vulnerability from nvd – Published: 2026-09-18 19:49 – Updated: 2026-09-18 19:49
    VLAI
    Title
    pg_partman privilege escalation via SQL injection when inheriting template properties
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:49:10.983Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-xqxh-6hh3-974m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-xqxh-6hh3-974m"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xqxh-6hh3-974m",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman privilege escalation via SQL injection when inheriting template properties"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61820",
    "datePublished": "2026-09-18T19:49:10.983Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-18T19:49:10.983Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61819 (GCVE-0-2026-61819)

    Vulnerability from nvd – Published: 2026-09-18 19:50 – Updated: 2026-09-18 20:17
    VLAI
    Title
    pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the literal and injects SQL when an affected exception path runs. If pg_partman_bgw reaches that path, the injected SQL executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The persistent part_config row can trigger the escalation again on later maintenance ticks. This issue is fixed in version 5.5.0.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 20:17 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61819",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:17:39.093763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:17:50.708Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the literal and injects SQL when an affected exception path runs. If pg_partman_bgw reaches that path, the injected SQL executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The persistent part_config row can trigger the escalation again on later maintenance ticks. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:50:06.940Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-gv5h-j2cm-rhc3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-gv5h-j2cm-rhc3"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gv5h-j2cm-rhc3",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61819",
    "datePublished": "2026-09-18T19:50:06.940Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-18T20:17:50.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61818 (GCVE-0-2026-61818)

    Vulnerability from nvd – Published: 2026-09-18 19:47 – Updated: 2026-09-19 14:11
    VLAI
    Title
    pg_partman SQL injection in undo partition time encoder
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-19 13:37 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:37:38.282887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:11:36.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:47:30.083Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-fm3m-9fh7-mqfc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-fm3m-9fh7-mqfc"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fm3m-9fh7-mqfc",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman SQL injection in undo partition time encoder"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61818",
    "datePublished": "2026-09-18T19:47:30.083Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-19T14:11:36.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61817 (GCVE-0-2026-61817)

    Vulnerability from nvd – Published: 2026-09-18 19:48 – Updated: 2026-09-19 14:11
    VLAI
    Title
    pg_partman privilege escalation via SQL injection in several functions via time decoder
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder function name. When an affected operation later uses the poisoned value, including pg_partman_bgw maintenance for a text- or UUID-keyed set, the SQL executes with the operation's privileges, which can be the default PostgreSQL superuser background-worker role. The persistent row can restore elevated access on later ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-19 13:37 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:37:45.837285Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:11:36.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder function name. When an affected operation later uses the poisoned value, including pg_partman_bgw maintenance for a text- or UUID-keyed set, the SQL executes with the operation\u0027s privileges, which can be the default PostgreSQL superuser background-worker role. The persistent row can restore elevated access on later ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:48:22.931Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-gmw2-52wc-258g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-gmw2-52wc-258g"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gmw2-52wc-258g",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman privilege escalation via SQL injection in several functions via time decoder"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61817",
    "datePublished": "2026-09-18T19:48:22.931Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-19T14:11:36.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61781 (GCVE-0-2026-61781)

    Vulnerability from nvd – Published: 2026-09-18 19:44 – Updated: 2026-09-18 20:16
    VLAI
    Title
    pg_partman has privilege escalation through SQL injection in create_partition_time()
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
    Severity
    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 20:16 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    • CWE-269 - Improper Privilege Management
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61781",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:16:05.846661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:16:17.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:44:40.018Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-742w-3j7c-qwvp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-742w-3j7c-qwvp"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-742w-3j7c-qwvp",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman has privilege escalation through SQL injection in create_partition_time()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61781",
    "datePublished": "2026-09-18T19:44:21.808Z",
    "dateReserved": "2026-07-10T20:06:05.616Z",
    "dateUpdated": "2026-09-18T20:16:17.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61819 (GCVE-0-2026-61819)

    Vulnerability from cvelistv5 – Published: 2026-09-18 19:50 – Updated: 2026-09-18 20:17
    VLAI
    Title
    pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the literal and injects SQL when an affected exception path runs. If pg_partman_bgw reaches that path, the injected SQL executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The persistent part_config row can trigger the escalation again on later maintenance ticks. This issue is fixed in version 5.5.0.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 20:17 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61819",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:17:39.093763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:17:50.708Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the literal and injects SQL when an affected exception path runs. If pg_partman_bgw reaches that path, the injected SQL executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The persistent part_config row can trigger the escalation again on later maintenance ticks. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:50:06.940Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-gv5h-j2cm-rhc3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-gv5h-j2cm-rhc3"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gv5h-j2cm-rhc3",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61819",
    "datePublished": "2026-09-18T19:50:06.940Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-18T20:17:50.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61820 (GCVE-0-2026-61820)

    Vulnerability from cvelistv5 – Published: 2026-09-18 19:49 – Updated: 2026-09-18 19:49
    VLAI
    Title
    pg_partman privilege escalation via SQL injection when inheriting template properties
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:49:10.983Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-xqxh-6hh3-974m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-xqxh-6hh3-974m"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xqxh-6hh3-974m",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman privilege escalation via SQL injection when inheriting template properties"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61820",
    "datePublished": "2026-09-18T19:49:10.983Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-18T19:49:10.983Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61817 (GCVE-0-2026-61817)

    Vulnerability from cvelistv5 – Published: 2026-09-18 19:48 – Updated: 2026-09-19 14:11
    VLAI
    Title
    pg_partman privilege escalation via SQL injection in several functions via time decoder
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder function name. When an affected operation later uses the poisoned value, including pg_partman_bgw maintenance for a text- or UUID-keyed set, the SQL executes with the operation's privileges, which can be the default PostgreSQL superuser background-worker role. The persistent row can restore elevated access on later ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-19 13:37 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:37:45.837285Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:11:36.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder function name. When an affected operation later uses the poisoned value, including pg_partman_bgw maintenance for a text- or UUID-keyed set, the SQL executes with the operation\u0027s privileges, which can be the default PostgreSQL superuser background-worker role. The persistent row can restore elevated access on later ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:48:22.931Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-gmw2-52wc-258g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-gmw2-52wc-258g"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gmw2-52wc-258g",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman privilege escalation via SQL injection in several functions via time decoder"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61817",
    "datePublished": "2026-09-18T19:48:22.931Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-19T14:11:36.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61818 (GCVE-0-2026-61818)

    Vulnerability from cvelistv5 – Published: 2026-09-18 19:47 – Updated: 2026-09-19 14:11
    VLAI
    Title
    pg_partman SQL injection in undo partition time encoder
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-19 13:37 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:37:38.282887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:11:36.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:47:30.083Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-fm3m-9fh7-mqfc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-fm3m-9fh7-mqfc"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fm3m-9fh7-mqfc",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman SQL injection in undo partition time encoder"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61818",
    "datePublished": "2026-09-18T19:47:30.083Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-19T14:11:36.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61821 (GCVE-0-2026-61821)

    Vulnerability from cvelistv5 – Published: 2026-09-18 19:46 – Updated: 2026-09-19 14:11
    VLAI
    Title
    pg_partman authorization bypass to move child tables between schemas during retention
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-19 13:37 UTC
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:37:30.159508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:11:36.998Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:46:41.985Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-pxp2-x8cf-rfhc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-pxp2-x8cf-rfhc"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-pxp2-x8cf-rfhc",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman authorization bypass to move child tables between schemas during retention"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61821",
    "datePublished": "2026-09-18T19:46:41.985Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-19T14:11:36.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61822 (GCVE-0-2026-61822)

    Vulnerability from cvelistv5 – Published: 2026-09-18 19:45 – Updated: 2026-09-18 19:45
    VLAI
    Title
    pg_partman disable maintenance for all partition sets
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes rows from part_config, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    CWE
    • CWE-703 - Improper Check or Handling of Exceptional Conditions
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes rows from part_config, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-703",
              "description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:45:49.852Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-9m6c-hw23-c6h2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-9m6c-hw23-c6h2"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-9m6c-hw23-c6h2",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman disable maintenance for all partition sets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61822",
    "datePublished": "2026-09-18T19:45:49.852Z",
    "dateReserved": "2026-07-10T20:17:57.992Z",
    "dateUpdated": "2026-09-18T19:45:49.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61781 (GCVE-0-2026-61781)

    Vulnerability from cvelistv5 – Published: 2026-09-18 19:44 – Updated: 2026-09-18 20:16
    VLAI
    Title
    pg_partman has privilege escalation through SQL injection in create_partition_time()
    Summary
    pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
    Severity
    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 20:16 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    • CWE-269 - Improper Privilege Management
    Assigner
    References
    Impacted products
    Vendor Product Version
    pgpartman pg_partman Affected: < 5.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61781",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:16:05.846661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:16:17.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pg_partman",
          "vendor": "pgpartman",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:44:40.018Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-742w-3j7c-qwvp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgpartman/pg_partman/security/advisories/GHSA-742w-3j7c-qwvp"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361"
        },
        {
          "name": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-742w-3j7c-qwvp",
        "discovery": "UNKNOWN"
      },
      "title": "pg_partman has privilege escalation through SQL injection in create_partition_time()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61781",
    "datePublished": "2026-09-18T19:44:21.808Z",
    "dateReserved": "2026-07-10T20:06:05.616Z",
    "dateUpdated": "2026-09-18T20:16:17.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}