CVE-2026-61821: PostgreSQL pg_partman Auth Bypass Vulnerability

CVE-2026-61821 Overview

CVE-2026-61821 is a missing authorization vulnerability [CWE-862] in pg_partman, a PostgreSQL extension that manages partitioned tables by time or ID. Versions prior to 5.5.0 allow a role with partman_user access to relocate retained child tables into schemas where the role lacks the standard CREATE privilege. The drop_partition_id() and drop_partition_time() functions accept any nonempty schema name for part_config.retention_schema and perform ALTER TABLE SET SCHEMA through the background worker. Because the worker runs with pg_partman_bgw.role privileges (defaulting to PostgreSQL superuser), the normal authorization check is bypassed.

Critical Impact
Authenticated users with partman_user access can move partitioned child tables into arbitrary schemas, bypassing PostgreSQL's schema-level access controls.

Affected Products

pg_partman versions prior to 5.5.0
PostgreSQL deployments using pg_partman_bgw background worker
Environments where pg_partman_bgw.role defaults to superuser

Discovery Timeline

2026-09-18 - CVE-2026-61821 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61821

Vulnerability Analysis

The flaw resides in the retention handling logic of pg_partman. When drop_partition_id() or drop_partition_time() runs with retention configured, the extension issues ALTER TABLE SET SCHEMA to relocate the aging child partition to the schema named in part_config.retention_schema. The extension neither validates that the invoking role holds CREATE on that target schema, nor restricts the accepted schema names. Any nonempty value is accepted as a valid destination.

The background worker (pg_partman_bgw) executes these SQL operations under pg_partman_bgw.role, which by default is a PostgreSQL superuser. This privilege elevation is the core of the bypass: PostgreSQL's ordinary permission check for ALTER TABLE SET SCHEMA requires CREATE on the target schema, but that check is satisfied by the superuser context rather than the calling partman_user role.

Root Cause

The root cause is a missing authorization check between the caller and the operation performed on their behalf. The extension trusts the value stored in part_config.retention_schema and delegates the privileged relocation to the background worker without confirming that the configuring role would independently be permitted to create objects in that schema.

Attack Vector

A role with partman_user access sets part_config.retention_schema to a schema of the attacker's choosing. When retention triggers, the background worker relocates the retained child table into that schema using superuser privileges. This allows unauthorized cross-schema movement of data objects and can be used to shadow expected object names, disrupt applications, or place tables in schemas visible to other tenants.

text

// Patch metadata change confirming the fix version
 {
     "name": "pg_partman",
     "abstract": "Extension to manage partitioned tables by time or ID",
-    "version": "5.4.3",
+    "version": "5.5.0",
     "maintainer": [
         "Keith Fiske <keith@keithf4.com>"
     ],

Source: GitHub Commit ba94055

Detection Methods for CVE-2026-61821

Indicators of Compromise

Unexpected part_config.retention_schema values referencing schemas the configuring role does not own.
Child partition tables appearing in schemas outside the documented partition retention layout.
PostgreSQL logs showing ALTER TABLE ... SET SCHEMA operations executed by the pg_partman_bgw worker against unusual targets.

Detection Strategies

Audit rows in part_config and compare retention_schema values against an allowlist of approved retention schemas.
Enable log_statement = 'ddl' in PostgreSQL to record all ALTER TABLE events and review those attributed to the background worker.
Correlate changes in pg_class.relnamespace for partitioned children against expected retention destinations.

Monitoring Recommendations

Alert on any modification to part_config rows made by roles other than a designated administrator.
Track the effective role of the pg_partman_bgw worker and flag configurations where it maps to a superuser.
Review PostgreSQL audit logs for SET SCHEMA events targeting schemas outside the retention namespace.

How to Mitigate CVE-2026-61821

Immediate Actions Required

Upgrade pg_partman to version 5.5.0 or later on all PostgreSQL instances using the extension.
Reduce pg_partman_bgw.role from superuser to a least-privilege role scoped only to the partitioned schemas.
Review current part_config.retention_schema values and reset any that reference unauthorized schemas.

Patch Information

The fix is available in pg_partman version 5.5.0. Details are published in the GitHub Security Advisory GHSA-pxp2-x8cf-rfhc and the GitHub Release v5.5.0. The patch is committed in GitHub Commit ba94055.

Workarounds

Restrict membership in the partman_user role to trusted database administrators until the upgrade is applied.
Revoke direct UPDATE privileges on part_config from application roles.
Set pg_partman_bgw.role to a non-superuser role that only has CREATE on approved retention schemas.

bash

# Upgrade pg_partman extension after installing 5.5.0 binaries
psql -d your_database -c "ALTER EXTENSION pg_partman UPDATE TO '5.5.0';"

# Verify installed version
psql -d your_database -c "SELECT extname, extversion FROM pg_extension WHERE extname = 'pg_partman';"