CVE-2026-61818 pg_partman SQL injection in undo partition time encoder
An attacker with partman_user access can inject SQL via time_encoder in undo_partition, leading to code execution and privilege escalation when invoked by a privileged caller.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61818?
CVE-2026-61818 is a high-severity SQL injection vulnerability in pgpartman pg_partman, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0.
Weakness: CWE-89
Which versions are affected by CVE-2026-61818?
How do I fix CVE-2026-61818?
Upgrade to a fixed version.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-61818 being exploited?
There is no known exploitation of CVE-2026-61818 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-61818, ECHO-2f72-c3a8-d1f3, GHSA-fm3m-9fh7-mqfc, UBUNTU-CVE-2026-61818.