An authenticated SQL injection vulnerability in pg_partman versions prior to 5.5.0 allows attackers to execute unauthorized commands with the privileges of the database user calling the function.

The vulnerability exists in the undo_partition function, which fails to properly sanitize the time_encoder parameter before interpolating it into a dynamic SELECT statement. An attacker possessing partman_user privileges can inject malicious SQL, which then executes with the permissions of the database user invoking the function.

The vulnerability carries a CVSS score of 8.5, reflecting its high potential for severe impact. Successful exploitation can lead to a complete compromise of data confidentiality, integrity, and availability within the database environment, as the injected code runs with the elevated privileges of the caller. This could result in unauthorized data exfiltration, modification of critical business records, or total service disruption.

Immediate Action: Upgrade the pg_partman extension to version 5.5.0 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review database audit logs for unusual queries or unexpected executions originating from users assigned the partman_user role.

Compensating Controls: Restrict permissions for the partman_user role to the minimum necessary level to reduce the potential impact should an account be compromised.

Public Exploit Available: Unknown.

Given the severity of this SQL injection flaw and its potential for privilege abuse within a PostgreSQL environment, organizations should prioritize the update to version 5.5.0. Administrators must verify that all instances of pg_partman are patched and ensure that database role assignments follow the principle of least privilege to minimize risk.