The Maintenance Worker Runs as Superuser: pg_partman's Config-Column SQL Injection (CVE-2026-61781)
pg_partman, the PostgreSQL partition manager, has a SQL injection (CVE-2026-61781, CWE-89 + CWE-269, CVSS 9.9) in create_partition_time(): the part_config.time_encoder column is interpolated raw with %s into a dynamically-executed statement. A low-privileged user who can only UPDATE part_config stores SQL instead of a function name. The functions are SECURITY INVOKER, so the attacker cannot self-escalate — but pg_partman's automated maintenance background worker runs as its documented default role postgres, a superuser, so the next privileged maintenance tick executes the payload with superuser rights: ALTER ROLE, then OS command execution as the postgres service account via COPY TO PROGRAM. Only text/uuid-keyed partition sets reach the encoder path. We reproduced the whole chain against pg_partman 5.4.3 (low-priv role to superuser to uid=999 postgres) and confirmed 5.5.0 neutralizes the identical payload with partman_safe_obj_name. Authenticated and low-priv, not unauthenticated RCE. The fix ships only in 5.5.0 (no backport) and also changes the worker default away from superuser.