CVE-2026-61817

pg_partman is a PostgreSQL extension for managing partitioned tables by time or ID. Prior to 5.5.0 , the functions run_maintenance() , show_partitions() , show_partition_info() , undo_partition() , and partition_data_time() interpolate the writable part_config.time_dncoder text value without iden...

CVE-2026-61818

pg_partman , a PostgreSQL extension for managing partitioned tables, is affected by an SQL injection in the undo_partition() function. Prior to version 5.5.0 , the function reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically execut...

CVE-2026-61821 pg_partman authorization bypass to move child tables between schemas during retention

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, droppartitionid and droppartitiontime use partconfig.retentionschema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partmanuser access can select a target...

CVE-2026-61821

CVE-2026-61821 affects the pg_partman PostgreSQL extension (which manages partitioned tables by time or ID). Prior to 5.5.0 , the functions drop_partition_id() and drop_partition_time() accept any nonempty value from part_config.retention_schema as the target for ALTER TABLE SET SCHEMA. A role wi...

CVE-2026-61822

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0 , the run_maintenance() function handles exceptions outside the loop that iterates over part_config rows, meaning a single exception in one partition set immediately terminates the entire loop and s...