CVE-2026-25212
Percona Monitoring and Management (PMM) versions before 3.7 allow an attacker with pmm-admin rights to run arbitrary shell commands on the host by abusing the "Add data source" feature. The flaw exists because an internal database user retains superuser privileges. This can lead to full system compromise.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Percona Monitoring and Management (PMM) versions prior to 3.7. Users who have pmm-admin rights on the system.
Real-world impact
An attacker who can add a data source can execute arbitrary shell commands on the underlying operating system, potentially taking full control of the host.
Why this severity
The CVSS score of 9.9 reflects that the vulnerability is exploitable over the network, requires low attack complexity, low privileges, no user interaction, and can compromise confidentiality, integrity, and availability.
What to do about it
- ›Restrict pmm-admin privileges to only necessary users.
- ›Disable or remove the "Add data source" feature if it is not needed.
- ›Monitor logs for unauthorized data source additions.
- ›Apply any future patch or upgrade to PMM 3.7 or later when available.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.
Timeline
- Apr 2, 2026 · Apr 2, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- docs.percona.com/percona-monitoring-and-mana…release notesvendor advisory
- percona.comproduct