CVE-2026-25212
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Percona PMM before version 3.7 has a vulnerability where an internal database user retains excessive superuser privileges. An attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying OS.
Risk Assessment
An attacker can gain full control over the operating system, leading to complete server compromise.
Recommendation
Update to version 3.7 or later and restrict pmm-admin privileges.
Original NVD description (English source)
An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying operating system.