EUVD-2026-83433Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated partman_user (PR:L) injects via a catalog identifier applied by a default-superuser BGW (AC:H, timing/config dependent); superuser + OS command execution justifies S:C and full C:H/I:H/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0.
Articles & Coverage 1
AnalysisAI
SQL injection in pg_partman before 5.5.0 allows an authenticated partman_user who owns a template table to escape the generated ALTER TABLE ADD PRIMARY KEY statement by placing a double-quote character in a column name, causing the background worker to run attacker-supplied SQL under the worker's role. Because pre-5.5.0 deployments effectively default pg_partman_bgw.role to a PostgreSQL superuser, successful exploitation yields database-wide compromise and operating-system command execution as the PostgreSQL service account, with the crafted catalog identifier persisting and re-triggering during later child-partition creation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated PostgreSQL role with partman_user privileges that OWNS a template table (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H = 8.5 HIGH) describes an authenticated (PR:L) SQL-injection/privilege-escalation flaw whose real severity hinges on a specific deployment precondition: the pg_partman background worker running as a PostgreSQL superuser (pg_partman_bgw.role defaulting to superuser in <5.5.0 setups). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 5.5.0 - upgrade pg_partman to 5.5.0 (see https://github.com/pgpartman/pg_partman/security/advisories/GHSA-xqxh-6hh3-974m and the release notes at https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0, fix commit ba9405542acf24dd881845b935cab8b165854361), which corrects the identifier quoting and simultaneously changes the background worker GUC default to the non-superuser role partman_maintainer. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every PostgreSQL instance running pg_partman (SELECT extversion FROM pg_extension WHERE extname='pg_partman') and flag any deployment below 5.5.0; on those instances immediately confirm the background worker role is not a superuser and restart it after repointing pg_partman_bgw.role to a dedicated least-privilege role, and audit template and child tables for column names containing double quotes while restricting template-table ownership to a tightly controlled group. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today