pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0,
    create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without
    identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user
    INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates
    a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with
    pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row
    can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit
    database-wide compromise and operating-system command execution as the PostgreSQL service account. This
    issue is fixed in version 5.5.0. (CVE-2026-61781)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0,     create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without     identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user     INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates     a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with     pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row     can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit     database-wide compromise and operating-system command execution as the PostgreSQL service account. This     issue is fixed in version 5.5.0. (CVE-2026-61781)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463112	Echo: pg-partman: security update to 5.5.0-1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
463112	Echo: pg-partman: security update to 5.5.0-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
348317	Linux Distros Unpatched Vulnerability : CVE-2026-61781	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-61781

critical

Tenable Plugins

critical

critical

critical