Description

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-18T20:17:19.780Z",
  "pubdate": "2026-09-18T20:17:19.780Z",
  "executiveSummary": "The PostgreSQL extension pg_partman contains a critical SQL injection vulnerability in the undo_partition() function, affecting versions prior to 5.5.0.\nThe vulnerability arises from the improper handling of the part_config.time_encoder parameter, which is treated as unrestricted text and interpolated into a dynamically executed SELECT statement without appropriate identifier quoting.\nAn attacker possessing partman_user privileges can inject arbitrary SQL commands into this parameter. These injected commands are subsequently executed with the security context and privileges of the database user who invokes the undo_partition() function.\nThis flaw allows for privilege escalation, unauthorized data access, and potential compromise of database integrity and availability if an administrative or highly privileged user executes the vulnerable function.\nWhile the function is not executed via the background worker, any manual invocation by a privileged user exposes the system to exploitation. Users should update to version 5.5.0 to remediate this vulnerability.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of dynamic SQL execution within the undo_partition() function of the pg_partman extension. Specifically, the function retrieves the time_encoder value from the part_config table and processes it without adequate sanitization or identifier quoting before incorporating it into a dynamic string intended for execution via the PostgreSQL SPI (Server Programming Interface).\nIn PostgreSQL, dynamic execution via functions such as EXECUTE or within PL/pgSQL blocks requires strict parameter handling to prevent code injection. By failing to use proper quoting functions like quote_ident() or quote_literal() for the time_encoder variable, the application allows the input to break out of its intended data context and influence the SQL command structure itself.\nThe attack flow proceeds as follows: First, an attacker with partman_user role permissions modifies the time_encoder configuration value for a specific partition entry within the part_config table. Instead of providing the expected function name, the attacker supplies a malicious SQL payload. Second, when a privileged user (such as a superuser or a role with elevated permissions) executes the undo_partition() function, the extension fetches the malicious string from part_config.time_encoder.\nThird, the vulnerable function concatenates this malicious input directly into a dynamic SQL query string. Because the database engine treats this concatenated string as a legitimate query, it executes the payload. Fourth, the payload executes with the effective permissions of the user calling undo_partition(), not the user who originally defined the malicious string in the configuration table. This behavior enables a 'confused deputy' attack, where a low-privileged user forces a higher-privileged user to execute arbitrary commands.\nThe impact of a successful exploit is significant, as the injected SQL runs with the privilege level of the caller. This could lead to unauthorized data exfiltration, modification of database schemas, bypass of row-level security policies, or disruption of database services. Because the flaw relies on the dynamic execution of string-concatenated SQL within the server-side extension, it effectively bypasses standard application-level controls once the malicious payload is persisted in the part_config table."
}