CVE-2026-61821High· 8.5▾ Twilightpg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any no…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61822Medium· 6.5pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID
CVE-2026-61819High· 8.5pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID
CVE-2026-61820High· 8.5pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID
CVE-2026-61817High· 8.5pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID
CVE-2026-61818High· 8.5pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID
CVE-2026-61781Critical· 9.9pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID