Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61781— pg_partman has privilege escalation through SQL injection in create_partition_time()

Quick assessment

Affected
pgpartman pg_partman
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pg_partman 是一个用于通过时间或 ID 管理分区表的 PostgreSQL 扩展。在 5.5.0 之前， 函数会读取可写的 文本值，并在动态执行的 SELECT 语句中对其进行插值，且未对标识符进行引号包裹（identifier quoting）。 具有文档所述的 的 INSERT 和 UPDATE 权限的角色可以存储 SQL 语句，而不仅仅是函数名称。 当 （后台工作进程）随后为基于文本或 UUID 键的表集创建子分区时，该工作进程会以 的权限执行所存储的 SQL 语句，而该角色默认是 PostgreS

CVSS 9.9 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
pgpartman pg_partman < 5.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61781

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pg_partman has privilege escalation through SQL injection in create_partition_time()
Source: CVE Program / CVE List V5
Vulnerability Description
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pgpartman pg_partman < 5.5.0 -

II. Public POCs for CVE-2026-61781

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61781

请登录查看更多情报信息。

Other References for CVE-2026-61781 (2)

Same Patch Batch · pgpartman · 2026-09-18 · 7 CVEs total

CVE-2026-61820 8.5 HIGH pg_partman privilege escalation via SQL injection when inheriting template properties
CVE-2026-61817 8.5 HIGH pg_partman privilege escalation via SQL injection in several functions via time decoder
CVE-2026-61818 8.5 HIGH pg_partman SQL injection in undo partition time encoder
CVE-2026-61819 8.5 HIGH pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering
CVE-2026-61821 8.5 HIGH pg_partman authorization bypass to move child tables between schemas during retention
CVE-2026-61822 6.5 MEDIUM pg_partman disable maintenance for all partition sets

IV. Related Vulnerabilities

Same product: pg_partman
Same vendor: pgpartman
Same weakness: CWE-89

V. Comments for CVE-2026-61781

No comments yet

Leave a comment