# CVE-2026-61819: pg_partman SQL injection and privilege escalation via jobmon

Source: https://junglewise.ai/threats/cve-2026-61819-pg-partman-is-a-postgresql-extension-that-manages-partitioned  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-61819 · Severity: high · CVSS 8.5 · Published 2026-09-18

pg_partman is a PostgreSQL extension that manages partitioned tables automatically. A vulnerability in versions prior to 5.5.0 allows attackers to inject arbitrary SQL code when an exception occurs in certain functions, provided pg_jobmon is installed. If the background worker runs as a superuser (the default in older versions), the injected SQL executes with superuser privileges, enabling complete database compromise and command execution as the PostgreSQL service account.

Technologies: [Pgpartman Pg Partman](https://junglewise.ai/threats/technologies/pg-partman). Vendors: [Pgpartman](https://junglewise.ai/threats/vendors/pgpartman).

## Quick answers

**Is CVE-2026-61819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61819 being exploited in the wild.

**How severe is CVE-2026-61819?** High severity, with a CVSS score of 8.5, published 18 September 2026.

**Which products and versions are affected?** Pgpartman Pg Partman prior to 5.5.0.

**Is there a fix for CVE-2026-61819?** A patch was published on 2026-07-22: Version 5.5.0 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61819 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61819?** Check whether you run Pgpartman Pg Partman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection flaw in exception handlers within pg_partman functions that construct SQL strings passed to pg_jobmon.add_job(). The p_parent_table parameter is inserted verbatim without proper escaping, allowing a partman_user to craft a parent table name containing a single quote that breaks out of the SQL literal and injects arbitrary code. The injected SQL executes in the context of pg_partman_bgw (the background worker), which defaults to PostgreSQL superuser privileges in affected versions. The malicious partition configuration persists and can re-trigger the vulnerability on subsequent maintenance operations.

## Affected products

- pgpartman pg_partman prior to 5.5.0

## Timeline

- 2026-09-18: disclosed: CVE-2026-61819 published
- 2026-07-22: patched: Version 5.5.0 released with security fixes

## References

- [https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361](https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b165854361)
- [https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0](https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0)

## Related threats

- [pg_partman denial of service via uncaught exception in maintenance loop](https://junglewise.ai/threats/cve-2026-61822-pg-partman-is-a-postgresql-extension-that-manages-partitioned)
- [pg_partman authorization bypass in drop_partition functions](https://junglewise.ai/threats/cve-2026-61821-pg-partman-is-a-postgresql-extension-that-manages-partitioned)
- [pg_partman SQL injection in inherit_template_properties](https://junglewise.ai/threats/cve-2026-61820-pg-partman-is-a-postgresql-extension-that-manages-partitioned)
- [pg_partman SQL injection in time_dncoder value](https://junglewise.ai/threats/cve-2026-61817-pg-partman-is-a-postgresql-extension-that-manages-partitioned)