CVE-2026-61781 pg_partman has privilege escalation through SQL injection in create_partition_time()
Privileged users can inject SQL into pg_partman configuration, leading to superuser privilege escalation and potential OS command execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61781?
CVE-2026-61781 is a critical SQL injection vulnerability in pgpartman pg_partman, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
Which versions are affected by CVE-2026-61781?
How do I fix CVE-2026-61781?
Upgrade to a fixed version.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-61781 being exploited?
There is no known exploitation of CVE-2026-61781 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-61781, ECHO-eee1-bd2d-6964, GHSA-742w-3j7c-qwvp, UBUNTU-CVE-2026-61781.