CVE-2026-61817 pg_partman privilege escalation via SQL injection in several functions via time decoder
Privileged users can inject SQL via time decoder settings in pg_partman, leading to superuser code execution and OS command execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61817?
CVE-2026-61817 is a high-severity SQL injection vulnerability in pgpartman pg_partman, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder function name. When an affected operation later uses the poisoned value, including pg_partman_bgw maintenance for a text- or UUID-keyed set, the SQL executes with the operation's privileges, which can be the default PostgreSQL superuser background-worker role. The persistent row can restore elevated access on later ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
Weakness: CWE-89
Which versions are affected by CVE-2026-61817?
How do I fix CVE-2026-61817?
Upgrade to a fixed version.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-61817 being exploited?
There is no known exploitation of CVE-2026-61817 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-61817, ECHO-d7c2-ca60-c9b7, GHSA-gmw2-52wc-258g, UBUNTU-CVE-2026-61817.