pgpartman pg_partman up to 5.4.x Undo Partition undo_partition privileges management

Summaryinfo

A vulnerability, which was classified as critical, was found in pgpartman pg_partman up to 5.4.x. Affected is the function undo_partition of the component Undo Partition. Such manipulation leads to privileges management. This vulnerability is referenced as CVE-2026-61818. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in pgpartman pg_partman up to 5.4.x. It has been rated as critical. Affected by this issue is the function undo_partition of the component Undo Partition. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-61818 since 07/10/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 5.5.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• pgpartman

Name

• pg_partman

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4

Website

• Product: https://github.com/pgpartman/pg_partman/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion