CVE catalog

CVE-2026-61820

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname

[CVE catalog]

Severity: High · CVSS 8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: Jul 22, 2026, 10:00:00 PM UTC
Updated: Sep 18, 2026, 8:17:20 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.73% · Oct 25, 2026

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pg-partman	sid	`5.5.0-1`	fixed
Debian	pg-partman	forky	`5.5.0-1`	fixed
Debian	pg-partman	trixie	`5.2.4-1`	vulnerable
Debian	pg-partman	bookworm	`4.7.2-1`	vulnerable
Ubuntu	pg-partman	16.04	`2.2.2-1`	vulnerable
Ubuntu	pg-partman	16.04	`2.2.2-2`	vulnerable
Ubuntu	pg-partman	18.04	`2.6.3-1`	vulnerable
Ubuntu	pg-partman	18.04	`3.1.0-1`	vulnerable
Ubuntu	pg-partman	18.04	`3.1.1-1`	vulnerable
Ubuntu	pg-partman	18.04	`3.1.2-1`	vulnerable
Ubuntu	pg-partman	20.04	`4.0.0-1`	vulnerable
Ubuntu	pg-partman	20.04	`4.2.0-1`	vulnerable
Ubuntu	pg-partman	20.04	`4.2.2-1`	vulnerable
Ubuntu	pg-partman	20.04	`4.3.0-1`	vulnerable
Ubuntu	pg-partman	22.04	`4.5.1-1`	vulnerable
Ubuntu	pg-partman	22.04	`4.6.0-1`	vulnerable
Ubuntu	pg-partman	24.04	`4.7.3-1`	vulnerable
Ubuntu	pg-partman	24.04	`5.0.0-2`	vulnerable
Ubuntu	pg-partman	24.04	`5.0.1-1`	vulnerable
Ubuntu	pg-partman	26.04	`5.2.4-1`	vulnerable
Ubuntu	pg-partman	26.04	`5.3.1-2`	vulnerable
Ubuntu	pg-partman	26.04	`5.4.0-1`	vulnerable
Ubuntu	pg-partman	26.04	`5.4.1-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pg-partman	source	sid	`5.5.0-1`	not yet assigned	Not reported	Not reported
Debian	pg-partman	source	forky	`5.5.0-1`	not yet assigned	Not reported	Not reported
Debian	pg-partman	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	pg-partman	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

Notes

[trixie] pg-partman: Minor issue [bookworm] pg-partman: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[postgresql-15-partman]Affected
Source package: [pg-partman]
Details (2)
- 4.7.2-1 · amd64 · bookworm
  Affected
  nvd · pg-partman · debian · bookworm; nvd · pg-partman · debian · 12
- 4.7.2-1 · arm64 · bookworm
  Affected
  nvd · pg-partman · debian · bookworm; nvd · pg-partman · debian · 12

[Debian 13 (Trixie)]

[postgresql-17-partman]Affected
Source package: [pg-partman]
Details (2)
- 5.2.4-1 · amd64 · trixie
  Affected
  nvd · pg-partman · debian · 13
- 5.2.4-1 · arm64 · trixie
  Affected
  nvd · pg-partman · debian · 13

Observed: Oct 23, 2026, 9:43:34 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]