Vulnerability Description
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b16
- https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0
- https://github.com/pgpartman/pg_partman/security/advisories/GHSA-pxp2-x8cf-rfhc
FAQ
What is CVE-2026-61821?
CVE-2026-61821 is a vulnerability with a CVSS score of 8.5 (HIGH). pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALT...
How severe is CVE-2026-61821?
CVE-2026-61821 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61821?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.