CVE-2026-25212: Percona PMM RCE Vulnerability

CVE-2026-25212 Overview

CVE-2026-25212 is a critical authenticated remote code execution vulnerability discovered in Percona Monitoring and Management (PMM) versions prior to 3.7. The vulnerability arises from an internal database user that retains specific superuser privileges, allowing an attacker with pmm-admin rights to abuse the "Add data source" feature. This security flaw enables attackers to break out of the database context and execute arbitrary shell commands on the underlying operating system.

Critical Impact
Authenticated attackers with pmm-admin privileges can achieve full remote code execution on the underlying server, potentially compromising the entire monitoring infrastructure and any systems it has access to.

Affected Products

Percona Monitoring and Management (PMM) versions prior to 3.7
PMM Server deployments with pmm-admin access enabled
Systems utilizing the internal database data source feature

Discovery Timeline

2026-04-02 - CVE-2026-25212 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-25212

Vulnerability Analysis

This vulnerability is classified under CWE-250 (Execution with Unnecessary Privileges). The core issue stems from improper privilege management within Percona PMM's architecture, where an internal database user maintains elevated superuser privileges that should have been restricted.

The vulnerability enables privilege escalation from the application layer to the operating system level. An authenticated user with pmm-admin rights can leverage the legitimate "Add data source" functionality to inject and execute malicious commands. This represents a significant container/context escape scenario where database operations can be weaponized to achieve shell access.

The network-accessible nature of this vulnerability, combined with the low complexity of exploitation, makes it particularly dangerous for exposed PMM deployments. While authentication is required (pmm-admin privileges), organizations often have multiple users with this level of access, expanding the potential attack surface.

Root Cause

The root cause lies in the retention of superuser privileges by an internal database user within Percona PMM. This design flaw violates the principle of least privilege, as the database user maintains permissions far exceeding what is necessary for normal operations. When combined with the "Add data source" feature's functionality, these excessive privileges create a pathway for command injection that escapes the intended database context boundaries.

Attack Vector

The attack vector is network-based, requiring the attacker to have valid pmm-admin credentials. Once authenticated, the attacker can navigate to the data source configuration interface and craft a malicious data source connection that exploits the overprivileged internal database user. The injected commands execute with the permissions of the underlying service account, typically granting significant access to the host operating system.

The exploitation flow involves:

Authenticating to PMM with pmm-admin privileges
Accessing the "Add data source" feature
Crafting a malicious data source configuration that injects shell commands
Executing the configuration to trigger command execution on the host

Detection Methods for CVE-2026-25212

Indicators of Compromise

Unusual data source configurations containing shell metacharacters or command injection patterns
Unexpected process spawning from the PMM server process or database service
Anomalous network connections originating from the PMM server to external hosts
Log entries showing attempts to add data sources with suspicious connection strings

Detection Strategies

Monitor PMM audit logs for data source creation events with unusual parameters
Implement file integrity monitoring on the PMM server to detect unauthorized changes
Deploy endpoint detection and response (EDR) solutions to identify command execution anomalies
Review data source configurations periodically for unexpected or malicious entries

Monitoring Recommendations

Enable verbose logging for the PMM server's data source management module
Configure alerting for new data source creation events outside of change windows
Monitor process trees on PMM hosts for unexpected child processes
Implement network segmentation monitoring to detect lateral movement attempts from PMM servers

How to Mitigate CVE-2026-25212

Immediate Actions Required

Upgrade Percona PMM to version 3.7 or later immediately
Audit current pmm-admin user accounts and remove unnecessary access
Review existing data source configurations for any signs of exploitation
Implement network segmentation to limit PMM server exposure

Patch Information

Percona has addressed this vulnerability in PMM version 3.7.0. The fix involves restricting the privileges of the internal database user to prevent command execution capabilities. Organizations should upgrade to PMM 3.7.0 or later as soon as possible. Detailed release notes are available in the Percona PMM 3.7.0 Release Notes.

Workarounds

Restrict pmm-admin access to only essential personnel until patching is complete
Implement additional authentication controls such as MFA for PMM administrative access
Place PMM servers behind a VPN or firewall to limit network accessibility
Monitor and alert on any data source configuration changes as an interim detection measure

bash

# Configuration example - Restrict network access to PMM
# Add firewall rules to limit PMM access to trusted networks only
iptables -A INPUT -p tcp --dport 443 -s <trusted_network>/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Review current data sources for suspicious entries
pmm-admin list --json | grep -i "data_source"