CVE-2026-61819

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0

Description When pg jobmon is installed and part config.jobmon is set to true, exception handlers in several functions place the p parent table variable verbatim into a SQL string literal used to call the pg jobmon.add job() function. A user with partman privileges can create a parent-table name containing a single quote to terminate the literal and inject SQL. If the pg partman bgw process reaches the affected exception path, the injected SQL executes with pg partman bgw.role privileges, which typically default to PostgreSQL superuser. This can lead to full database compromise and the execution of operating-system commands as the PostgreSQL service account. The persistent part config row may trigger this escalation during subsequent maintenance ticks.

Recommendations Update to version 5.5.0.