EUVD-2026-83425Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Authenticated partman_user (PR:L) over the network (AV:N), no interaction; superuser BGW crosses tenant authority (S:C); primary impact is cross-tenant table/ownership takeover (I:H) with incidental read (C:L), no availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0.
Articles & Coverage 1
AnalysisAI
Unauthorized relocation of retained partition child tables in pg_partman before 5.5.0 lets an authenticated database role holding partman_user access move another tenant's child tables into a schema it does not own. The cause is that drop_partition_id() and drop_partition_time() pass part_config.retention_schema straight into ALTER TABLE SET SCHEMA, and the background worker executes the move under pg_partman_bgw.role - a PostgreSQL superuser by default before this release - so the privilege check that normally guards SET SCHEMA is never enforced. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated PostgreSQL role holding partman_user access (PR:L) in a database running pg_partman prior to 5.5.0, AND the pg_partman background worker configured with pg_partman_bgw.role set to a superuser (the pre-5.5.0 default) so the BGW performs ALTER TABLE SET SCHEMA with superuser privileges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded broken-authorization flaw (CWE-862), not a headline-grade remote takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to pg_partman 5.5.0 (release tag v5.5.0, fix commit ba9405542acf24dd881845b935cab8b165854361); the vendor advisory is at https://github.com/pgpartman/pg_partman/security/advisories/GHSA-pxp2-x8cf-rfhc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, set pg_partman_bgw.role to a dedicated non-superuser role on every PostgreSQL instance running pg_partman, since the vendor confirms this fully neutralizes the escalation and can be applied immediately without upgrading; inventory every role with partman_user and every part_config.retention_schema value to identify which accounts could redirect retained child tables, and revoke partman_user from roles that do not need it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today