CVE-2026-61820: PostgreSQL pg_partman RCE Vulnerability

CVE-2026-61820 Overview

CVE-2026-61820 is a SQL injection vulnerability in pg_partman, a PostgreSQL extension that manages partitioned tables by time or ID. The flaw resides in the inherit_template_properties() function, which wraps primary-key column names from pg_attribute.attname in double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can craft a column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier. The injected SQL runs under pg_partman_bgw.role, which defaults to PostgreSQL superuser. The issue is fixed in version 5.5.0.

Critical Impact

Successful exploitation grants database-wide compromise and operating-system command execution as the PostgreSQL service account.

Affected Products

• pg_partman PostgreSQL extension, all versions prior to 5.5.0
• PostgreSQL deployments using pg_partman with the background worker enabled
• Systems where pg_partman_bgw.role remains at its default superuser value

Discovery Timeline

• 2026-09-18 - CVE-2026-61820 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61820

Vulnerability Analysis

The inherit_template_properties() function in pg_partman reads primary-key column names directly from the PostgreSQL catalog (pg_attribute.attname) and concatenates them into a dynamic ALTER TABLE ADD PRIMARY KEY statement. The function wraps identifiers in double quotes but does not escape embedded double-quote characters. This mirrors the classic pattern captured in CWE-89: SQL Injection, where quoting is applied without corresponding sanitization.

Because the malicious identifier is stored in the catalog, it persists across sessions and re-triggers each time the background worker creates a new child partition. Execution runs under the elevated privileges of pg_partman_bgw.role, permitting arbitrary SQL, filesystem access, and command execution through PostgreSQL features such as COPY ... PROGRAM.

Root Cause

The root cause is improper neutralization of special elements in dynamically generated SQL. The function relies on manual quoting rather than PostgreSQL's built-in identifier quoting helper quote_ident(), which correctly doubles embedded quotes. Any catalog-supplied column name containing a " character escapes the intended identifier context and is parsed as SQL.

Attack Vector

An authenticated partman_user who owns a template table creates a column whose name contains a double-quote followed by injected SQL. When the pg_partman background worker (pg_partman_bgw) applies the primary key to a child partition, the injected fragment executes with superuser privileges. The attack requires low privileges but higher complexity, since it depends on the background worker's partition creation cycle.

Below is the version metadata change from the fix commit, confirming the corrected release:

 {
     "name": "pg_partman",
     "abstract": "Extension to manage partitioned tables by time or ID",
-    "version": "5.4.3",
+    "version": "5.5.0",
     "maintainer": [
         "Keith Fiske <keith@keithf4.com>"
     ],

Source: pg_partman commit ba94055

Detection Methods for CVE-2026-61820

Indicators of Compromise

• Column names in pg_attribute containing embedded double-quote (") characters on tables owned by partman_user roles
• Unexpected ALTER TABLE or DDL statements in PostgreSQL logs originating from the pg_partman_bgw background worker
• New superuser roles, extensions, or COPY ... PROGRAM invocations created during partition maintenance windows

Detection Strategies

• Query pg_attribute for attname values containing " and validate ownership of parent template tables managed by pg_partman
• Enable log_statement = 'ddl' in PostgreSQL and alert on background-worker DDL that references unusual identifiers
• Correlate PostgreSQL process activity with operating-system process creation on the database host to identify command execution as the PostgreSQL service account

Monitoring Recommendations

• Monitor pg_partman_bgw execution logs for parse errors or unexpected statement structures
• Track privilege changes on pg_partman_bgw.role and any role escalations tied to partition maintenance
• Ingest PostgreSQL audit logs into a centralized analytics pipeline for anomaly detection on DDL patterns

How to Mitigate CVE-2026-61820

Immediate Actions Required

• Upgrade pg_partman to version 5.5.0 or later on all PostgreSQL instances
• Audit existing template tables for column names containing double-quote characters and remove any crafted identifiers
• Restrict membership in partman_user and any role permitted to own template tables

Patch Information

The fix is released in pg_partman version 5.5.0. The default_version in pg_partman.control was updated accordingly:

-default_version = '5.4.3'
+default_version = '5.5.0'
 comment = 'Extension to manage partitioned tables by time or ID'
 relocatable = false
 superuser = false

Source: pg_partman commit ba94055. Additional details are available in the GitHub Security Advisory GHSA-xqxh-6hh3-974m and pg_partman Release v5.5.0.

Workarounds

• Set pg_partman_bgw.role to a non-superuser role with only the privileges required for partition management
• Revoke CREATE privileges on template schemas from untrusted users until the upgrade is applied
• Temporarily disable the pg_partman background worker if partition automation is not business-critical

# Set the background worker to run as a least-privilege role
ALTER SYSTEM SET pg_partman_bgw.role = 'partman_bgw_limited';
SELECT pg_reload_conf();

# Verify current pg_partman version
SELECT extname, extversion FROM pg_extension WHERE extname = 'pg_partman';