CVE-2026-61818

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0

Description The undo partition() function reads the time encoder variable from the part config table as unrestricted text and interpolates it into a dynamically executed SELECT statement without identifier quoting. A user with partman user access can store arbitrary SQL instead of a function name. This SQL is then executed with the privileges of the caller who invokes undo partition(), potentially allowing the abuse of the caller's confidentiality, integrity, and availability permissions.

Recommendations Update to version 5.5.0.