CVE-2026-61817 in pg_partman
Summary
by MITRE • 09/18/2026
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder function name. When an affected operation later uses the poisoned value, including pg_partman_bgw maintenance for a text- or UUID-keyed set, the SQL executes with the operation's privileges, which can be the default PostgreSQL superuser background-worker role. The persistent row can restore elevated access on later ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in pg_partman versions prior to 5.5.0 represents a critical server-side request forgery and SQL injection flaw rooted in improper neutralization of special elements within dynamic SQL construction. pg_partman serves as an extension for PostgreSQL that automates the management of partitioned tables, handling operations such as time-based or ID-based partitioning strategies. The core technical failure lies in how specific maintenance functions interpolate configuration values into executable code without proper sanitization. Specifically, the run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() functions take the writable part_config.time_dncoder text value and insert it directly into dynamic SQL statements. This interpolation occurs without applying identifier quoting or parameterized queries, which is a fundamental violation of secure coding practices for database extensions that handle user-defined configuration data.
The operational impact stems from the privilege model associated with pg_partman users. A role possessing documented partman_user privileges has write access to certain configuration tables within the extension schema. Due to the lack of input validation on the time_dncoder field, an attacker with these limited privileges can inject arbitrary SQL code instead of providing a valid decoder function name. This injected payload is stored persistently in the database configuration rather than being executed immediately during insertion. The execution occurs later when maintenance operations are triggered, either manually or automatically via the pg_partman background worker process. Because this background worker typically runs with elevated privileges, often equivalent to the default PostgreSQL superuser role for managing partitions efficiently, any SQL code stored within the poisoned configuration row is executed under these high-privilege contexts.
This architectural design flaw allows a low-privileged user to achieve privilege escalation and potentially full database compromise. By crafting a malicious payload in the time_dncoder field, an attacker can execute arbitrary commands with the privileges of the background worker process. In many PostgreSQL deployments, this service account has significant access rights that may extend beyond the immediate database schema, potentially allowing for operating-system command execution if specific extensions like PL/Python or external program calls are enabled and configured to allow such actions by superusers. The persistent nature of the vulnerability means that once a malicious configuration is stored, it can restore elevated access on subsequent maintenance ticks, creating a reliable backdoor mechanism even after initial remediation attempts might be bypassed through repeated execution cycles.
From a classification perspective, this issue aligns with CWE-94 Improper Control of Generation of Code (SQL Injection), as the application constructs SQL code using user-controlled input without proper neutralization. It also relates to CWE-78 Improper Neutralization of Special Elements used in an OS Command if the injected payload leads to operating-system level execution, and CWE-269 Improvement of Privilege Context which describes the escalation from a limited partman_user role to superuser-level privileges via the background worker process. In terms of the MITRE ATT&CK framework for databases, this vulnerability facilitates T1059 Command and Scripting Interpreter through SQL injection techniques (T1059.004) and allows for Privilege Escalation by exploiting trusted processes or services running with higher privileges than the initial attacker context.
Mitigation strategies must prioritize immediate version upgrades to pg_partman 5.5.0 or later, where this interpolation flaw has been corrected through proper identifier quoting and input validation mechanisms. For environments unable to upgrade immediately, administrators should audit part_config tables for any anomalous entries in the time_dncoder field that do not correspond to legitimate function names. Additionally, restricting the privileges of the pg_partman background worker process can limit the blast radius of such an exploitation attempt by ensuring it does not run with superuser rights unless absolutely necessary for specific partitioning operations. Implementing strict role-based access control and monitoring database logs for unusual SQL execution patterns originating from maintenance functions can also aid in early detection of attempted exploits targeting this vulnerability.