CVE-2026-61781: Critical pg_partman Privilege Escalation and RCE

How to Detect CVE-2026-61781

Detection should begin with an inventory of installed extension versions and the privileges surrounding pg_partman. Identify databases containing the extension, inspect the worker role, and locate partition configurations whose time_encoder values are unexpected, unusually complex, or inconsistent with approved function names.

A suspicious value may contain SQL syntax, statement separators, comments, casts, subqueries, or function calls rather than a simple trusted identifier. The exact table schema and column representation can vary by pg_partman release, so administrators should validate the query against the installed extension before using it operationally.

Technical Notes

The following example is an investigative starting point, not a universal schema guarantee:

-- Run with an account authorized to inspect pg_partman metadata.
SELECT parent_table,
       partition_type,
       time_encoder
FROM partman.part_config
WHERE time_encoder IS NOT NULL
  AND (
       time_encoder LIKE '%;%' OR
       time_encoder LIKE '%--%' OR
       time_encoder LIKE '%/*%' OR
       time_encoder LIKE '%SELECT%' OR
       time_encoder LIKE '%(%'
      );

Review the worker role and memberships:

SHOW pg_partman_bgw.role;

SELECT rolname, rolsuper, rolcanlogin
FROM pg_roles
WHERE rolname = current_setting('pg_partman_bgw.role', true);

SELECT member.rolname AS member_name,
       role_name.rolname AS granted_role
FROM pg_auth_members m
JOIN pg_roles member ON member.oid = m.member
JOIN pg_roles role_name ON role_name.oid = m.roleid
WHERE role_name.rolname ILIKE '%partman%';

For PostgreSQL logging, search for unexpected statements emitted around background maintenance, especially SQL that references partition creation and unusual function or identifier content:

grep -Ei \
'CREATE TABLE .*_p[0-9]|create_partition_time|pg_partman|SELECT .*time_encoder|background worker' \
/var/log/postgresql/postgresql-*.log

A single matching log line does not prove exploitation. Correlate database activity with configuration changes, the modifying role, worker execution times, failed partition-maintenance jobs, and any subsequent privileged DDL or operating-system activity. If PostgreSQL auditing is enabled, prioritize UPDATE statements against partman.part_config and activity performed by the configured background-worker role.

If suspicious activity is confirmed, follow a structured incident process, including containment, evidence preservation, credential review, and host investigation. The first-hour ransomware response checklist provides related guidance for prioritizing early investigative actions, although this vulnerability does not by itself indicate ransomware activity.

Mitigation and Patching

Upgrade the pg_partman extension to version 5.5.0 or later. The project’s 5.5.0 release and associated fix address the vulnerable code path described for versions before 5.5.0. Because PostgreSQL extensions are installed per database, verify and upgrade every database using pg_partman, not only the host-level package or one administrative database.

Before upgrading, preserve relevant configuration and establish a rollback plan appropriate to the organization’s PostgreSQL support process. Afterward, confirm the installed extension version from each affected database and test partition maintenance. Also review whether the background worker is unnecessarily configured to run as superuser; reducing its privileges limits impact if another configuration or extension issue is later discovered.

Technical Notes

The exact package manager command depends on the operating system and PostgreSQL distribution. For source-controlled or project-managed installations, follow the documented release workflow and then upgrade the extension in each database. A representative PostgreSQL extension upgrade is:

# Use the package or build artifact containing pg_partman 5.5.0 or later.
# Then run in each affected database:
psql -d "$DB_NAME" -v ON_ERROR_STOP=1 \
  -c 'ALTER EXTENSION pg_partman UPDATE TO '\''5.5.0'\'';'

Verify the result:

SELECT extname, extversion
FROM pg_extension
WHERE extname = 'pg_partman';

If an immediate upgrade is impossible, apply layered controls:

1. Restrict INSERT and UPDATE access to the relevant pg_partman configuration tables.
2. Remove unnecessary membership in roles that provide partman_user capabilities.
3. Disable or stop the pg_partman_bgw worker where operationally safe.
4. Configure the worker with the least-privileged role supported by the deployment rather than PostgreSQL superuser.
5. Review and normalize existing time_encoder values against an approved allowlist.
6. Monitor configuration changes and background-worker SQL activity.

These are compensating controls, not replacements for version 5.5.0 or later. If suspicious configuration or execution is found, isolate the database from untrusted roles, preserve logs, rotate potentially exposed credentials, inspect for persistence, and investigate the PostgreSQL host for commands executed as the service account.

During incident response, use approved endpoint and malware investigation tooling, such as Malwarebytes, only as part of a broader forensic process. Database logs, operating-system telemetry, and evidence preservation remain essential.

References

The authoritative references supplied for this assessment are the NVD record, the project’s remediation commit, the 5.5.0 release, and the GitHub security advisory. The NVD record should be checked directly for the current CVSS vector and any later updates to affected-version or exploitation information.

• NVD: CVE-2026-61781
• pg_partman remediation commit
• pg_partman 5.5.0 release
• GitHub Security Advisory GHSA-742w-3j7c-qwvp
• CISA Known Exploited Vulnerabilities Catalog

At publication time, the supplied research indicates no confirmed active exploitation, no independently verified standalone public PoC, and no CISA KEV listing. Those statuses can change; maintainers and defenders should recheck the references during triage and before closing the remediation record.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.