PT-2026-29794 · Percona · Percona Pmm

Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-25212

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Percona PMM versions prior to 3.7

Description A flaw exists in Percona PMM that allows an attacker with pmm-admin rights to execute shell commands on the underlying operating system. This is possible because an internal database user retains specific superuser privileges, which can be exploited through the 'Add data source' feature to break out of the database context.

Recommendations Update Percona PMM to version 3.7 or later.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2026-25212

Affected Products

Percona Pmm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-25212 · Security Note
• https://twitter.com/TheHackerWire/status/2039976307921223722 · Twitter Post
• https://docs.percona.com/percona-monitoring-and-management/3/release-notes/3.7.0.html#authenticated-remote-code-execution-via-internal-data-source-cve-2026-25212 · Note
• https://percona.com · Note