CVE-2026-61781

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, createpartitiontime() reads the writable partconfig.timeencoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partmanuser INSERT and UPDATE privileges can store SQL rather than a function name. When pgpartmanbgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pgpartmanbgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.