EUVD-2026-83427Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated partman_user (PR:L) and a required privileged second caller make it AC:H; injection stays within one DB authority so S:U, but a high-privileged caller yields full C/I/A.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0.
Articles & Coverage 1
AnalysisAI
SQL injection in pg_partman prior to 5.5.0 lets a role with partman_user access store arbitrary SQL - rather than a legitimate function name - in the part_config.time_encoder column, which undo_partition() interpolates into a dynamically executed SELECT without identifier quoting and runs with the privileges of whichever caller invokes that function. Exploitation is a two-step confused-deputy chain: an authenticated writer plants the payload, and a separate more-privileged role must later call undo_partition() on the same partition set, which is why the assessed vector is AV:N/AC:H/PR:L with impact bounded by the invoking caller rather than the attacker, and it does not carry the automatic superuser escalation of the background-worker create-partition flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated role with partman_user access to write to the part_config.time_encoder column (PR:L), plus a separate, more-privileged role that subsequently invokes undo_partition() on the affected partition set - this confused-deputy dependency is what makes exploitation AC:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine SQL injection / privilege-escalation flaw (CWE-89) in pg_partman's undo_partition(), but it sits below its more dangerous sibling CVE-2026-61781. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade pg_partman to the fixed release: Vendor-released patch: 5.5.0, available from the v5.5.0 tag (https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0) and the fixing commit ba9405542acf24dd881845b935cab8b165854361 (https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361); after installing the new extension files, run ALTER EXTENSION pg_partman UPDATE so the corrected undo_partition() definition is actually loaded. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which database clusters run pg_partman below 5.5.0 and identify every role granted partman_user or write access to part_config; immediately revoke direct INSERT and UPDATE rights on the part_config table from non-administrative roles and restrict EXECUTE on undo_partition(), undo_partition_proc() and related maintenance functions to a small, named set of administrative accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today