Bug 2538179 (CVE-2026-61820)

Summary: CVE-2026-61820 pg_partman: privilege escalation via SQL injection when inheriting template properties
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in pg_partman. A local user with partman_user privileges, who owns a template table, can exploit a SQL injection issue within the inherit_template_properties function. By crafting a malicious column name, the user can bypass proper escaping, allowing arbitrary SQL commands to be executed. This leads to privilege escalation, as the injected SQL runs with the elevated permissions of the pg_partman_bgw.role, which defaults to PostgreSQL superuser. This can result in a complete compromise of the database and potential execution of operating-system commands as the PostgreSQL service account.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2540726    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-22 17:23:04 UTC 
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0.