pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the literal and injects SQL when an affected exception path runs. If pg_partman_bgw reaches that path, the injected SQL executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The persistent part_config row can trigger the escalation again on later maintenance ticks. This issue is fixed in version 5.5.0.
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0.
CVE-2026-61817 is a high-severity SQL injection vulnerability in the pg_partman PostgreSQL extension prior to version 5.5.0. It arises from improper neutralization of special elements in dynamic SQL commands related to the part_config.time_dncoder value. A user with partman_user privileges can inject arbitrary SQL that executes with elevated privileges, potentially leading to full database compromise and operating system command execution. The issue is fixed in pg_partman version 5.5.0.
CVE-2026-61818 is a high-severity SQL injection vulnerability in the pg_partman PostgreSQL extension prior to version 5.5.0. The undo_partition() function improperly handles the part_config.time_encoder parameter by interpolating it as unrestricted text into a dynamic SQL statement without proper quoting. This allows a user with partman_user role access to inject arbitrary SQL code, which executes with the privileges of the caller invoking undo_partition(). Although this function is not part of the default background-worker path, limiting automatic superuser escalation, a privileged caller can still abuse their permissions for confidentiality, integrity, and availability impacts. The vulnerability is fixed in version 5.5.0.
CVE-2026-61821 is a high-severity authorization bypass vulnerability in the pg_partman PostgreSQL extension prior to version 5.5.0. It allows a role with partman_user access to relocate retained child tables between schemas without proper CREATE privileges, exploiting the background worker's superuser-level privileges. This bypasses normal ALTER TABLE SET SCHEMA authorization checks. The issue is fixed in pg_partman version 5.5.0.
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes rows from part_config, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0.
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.