Bug 2538179 (CVE-2026-61820) - CVE-2026-61820 pg_partman: privilege escalation via SQL injection when inheriting template properties
Summary: CVE-2026-61820 pg_partman: privilege escalation via SQL injection when inheri...
Keywords:
Status: NEW
Alias: CVE-2026-61820
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2540726
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-22 17:23 UTC by OSIDB Bzimport
Modified: 2026-09-24 19:09 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-22 17:23:04 UTC
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0.


Note You need to log in before you can comment on or make changes to this bug.