CVE-2026-61821 pg_partman authorization bypass to move child tables between schemas during retention
A low-privileged user can bypass authorization checks to move partitioned tables between schemas using the background worker's superuser privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61821?
CVE-2026-61821 is a high-severity missing authorization vulnerability in pgpartman pg_partman, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-61821?
How do I fix CVE-2026-61821?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-61821 being exploited?
There is no known exploitation of CVE-2026-61821 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-61821, ECHO-e95d-6841-c84a, GHSA-pxp2-x8cf-rfhc, UBUNTU-CVE-2026-61821.