EUVD-2026-83418Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Low-privilege authenticated partman_user (PR:L) injects SQL executed by the superuser-default BGW, crossing a privilege boundary (S:C) for full C/I/A including OS command execution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
Articles & Coverage 2
AnalysisAI
SQL injection in the pg_partman PostgreSQL extension before version 5.5.0 lets an authenticated database role that holds the documented partman_user INSERT/UPDATE privileges on the part_config table store SQL text in the writable time_encoder column instead of a legitimate function name. When the pg_partman_bgw background worker next creates a child partition for a text- or UUID-keyed set, that stored SQL is interpolated into a dynamically executed SELECT and runs with the privileges of pg_partman_bgw.role, which the pre-5.5.0 documentation defaults to a superuser such as 'postgres'; because the payload persists in the configuration row, elevated access can be re-established on subsequent maintenance ticks and can lead to database-wide compromise and operating-system command execution as the PostgreSQL service account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) an authenticated database role holding the documented partman_user INSERT/UPDATE privileges on part_config, (2) a partition set keyed by text or UUID whose time_encoder value is consulted during child-partition creation, and (3) pg_partman_bgw.role configured as a superuser (the pre-5.5.0 documented default, e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 5.5.0 - upgrade pg_partman to 5.5.0 or later, applying the fix commit ba9405542acf24dd881845b935cab8b165854361 and following advisory GHSA-742w-3j7c-qwvp and the release notes at https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every PostgreSQL instance running the pg_partman extension (SELECT extname, extversion FROM pg_extension WHERE extname = 'pg_partman') and flag any deployment below version 5.5.0; on those instances immediately revoke INSERT and UPDATE on the part_config table from all roles other than the extension owner, reassign pg_partman_bgw.role to a dedicated non-superuser role rather than 'postgres', and audit the time_encoder column in part_config for values that are not legitimate function names. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today