CVE-2026-61821 in pg_partman
Summary
by MITRE • 09/18/2026
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in pg_partman versions prior to 5.5.0 represents a significant authorization bypass within the PostgreSQL partition management extension. pg_partman serves as a critical tool for database administrators, automating the creation and maintenance of partitioned tables based on time or ID ranges. The core flaw resides in the implementation of the drop_partition_id() and drop_partition_time() functions, which are designed to remove old partitions by relocating them to a retention schema defined by part_config.retention_schema before eventual deletion. In vulnerable versions, these functions fail to validate whether the executing role possesses the necessary CREATE privileges on the target retention schema. This oversight allows any user granted access as a pg_partman_user to specify an arbitrary non-empty schema name for relocation, even if that schema is owned by another role or resides in a restricted namespace where the user has no write permissions.
The operational impact of this flaw is exacerbated by the execution context of the background worker process responsible for handling partition maintenance tasks. By default, pg_partman_bgw operates with superuser privileges to ensure it can perform complex administrative operations without being hindered by standard permission restrictions. When a malicious or compromised user triggers a drop operation via the vulnerable functions, the database engine executes the ALTER TABLE SET SCHEMA command under these elevated background worker credentials rather than the permissions of the initiating user. This effectively bypasses the standard PostgreSQL authorization checks that would normally prevent an unauthorized role from moving objects into schemas where they lack CREATE privileges. Consequently, this allows for the unauthorized relocation of retained child tables between schemas, potentially leading to data exfiltration, disruption of service by hiding or misplacing critical partitioned data, or further privilege escalation if combined with other vulnerabilities within the database environment.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, specifically highlighting the failure to enforce proper authorization checks during administrative operations. It also relates to CWE-732, as it involves incorrect permission assignment that allows actions beyond intended user capabilities. In terms of offensive security frameworks such as MITRE ATT&CK for Enterprise or Database, this behavior is consistent with techniques involving unauthorized access and lateral movement within the database layer, where an attacker leverages misconfigured service accounts to bypass standard access controls. The vulnerability essentially transforms a routine maintenance function into a vector for privilege escalation by exploiting the trust relationship between the application logic and the elevated background worker context.
To mitigate this risk, organizations must immediately upgrade pg_partman to version 5.5.0 or later, where the developers have implemented strict validation checks to ensure that only users with appropriate CREATE privileges on the target schema can perform these operations. For environments unable to patch immediately due to dependency constraints, a temporary mitigation involves restricting the permissions of the background worker role if possible, although this may impact other legitimate maintenance functions. Additionally, database administrators should audit existing pg_partman configurations to identify any roles that have been granted excessive privileges beyond what is strictly necessary for partition management. Implementing strict least-privilege principles and regularly reviewing schema ownership and permission grants can further reduce the attack surface associated with such administrative extensions.