CVE-2026-25212: Percona PMM RCE Vulnerability

CVE-2026-25212 Overview

CVE-2026-25212 is a critical authenticated remote code execution vulnerability discovered in Percona Monitoring and Management (PMM) versions prior to 3.7. The vulnerability arises from an internal database user that retains specific superuser privileges, allowing an attacker with pmm-admin rights to abuse the "Add data source" feature. This security flaw enables attackers to break out of the database context and execute arbitrary shell commands on the underlying operating system.

Critical Impact

Authenticated attackers with pmm-admin privileges can achieve full remote code execution on the underlying server, potentially compromising the entire monitoring infrastructure and any systems it has access to.

Affected Products

• Percona Monitoring and Management (PMM) versions prior to 3.7
• PMM Server deployments with pmm-admin access enabled
• Systems utilizing the internal database data source feature

Discovery Timeline

• 2026-04-02 - CVE-2026-25212 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-25212

Vulnerability Analysis

This vulnerability is classified under CWE-250 (Execution with Unnecessary Privileges). The core issue stems from improper privilege management within Percona PMM's architecture, where an internal database user maintains elevated superuser privileges that should have been restricted.

The vulnerability enables privilege escalation from the application layer to the operating system level. An authenticated user with pmm-admin rights can leverage the legitimate "Add data source" functionality to inject and execute malicious commands. This represents a significant container/context escape scenario where database operations can be weaponized to achieve shell access.

The network-accessible nature of this vulnerability, combined with the low complexity of exploitation, makes it particularly dangerous for exposed PMM deployments. While authentication is required (pmm-admin privileges), organizations often have multiple users with this level of access, expanding the potential attack surface.

Root Cause

The root cause lies in the retention of superuser privileges by an internal database user within Percona PMM. This design flaw violates the principle of least privilege, as the database user maintains permissions far exceeding what is necessary for normal operations. When combined with the "Add data source" feature's functionality, these excessive privileges create a pathway for command injection that escapes the intended database context boundaries.

Attack Vector

The attack vector is network-based, requiring the attacker to have valid pmm-admin credentials. Once authenticated, the attacker can navigate to the data source configuration interface and craft a malicious data source connection that exploits the overprivileged internal database user. The injected commands execute with the permissions of the underlying service account, typically granting significant access to the host operating system.

The exploitation flow involves:

1. Authenticating to PMM with pmm-admin privileges
2. Accessing the "Add data source" feature
3. Crafting a malicious data source configuration that injects shell commands
4. Executing the configuration to trigger command execution on the host

Detection Methods for CVE-2026-25212

Indicators of Compromise

• Unusual data source configurations containing shell metacharacters or command injection patterns
• Unexpected process spawning from the PMM server process or database service
• Anomalous network connections originating from the PMM server to external hosts
• Log entries showing attempts to add data sources with suspicious connection strings

Detection Strategies

• Monitor PMM audit logs for data source creation events with unusual parameters
• Implement file integrity monitoring on the PMM server to detect unauthorized changes
• Deploy endpoint detection and response (EDR) solutions to identify command execution anomalies
• Review data source configurations periodically for unexpected or malicious entries

Monitoring Recommendations

• Enable verbose logging for the PMM server's data source management module
• Configure alerting for new data source creation events outside of change windows
• Monitor process trees on PMM hosts for unexpected child processes
• Implement network segmentation monitoring to detect lateral movement attempts from PMM servers

How to Mitigate CVE-2026-25212

Immediate Actions Required

• Upgrade Percona PMM to version 3.7 or later immediately
• Audit current pmm-admin user accounts and remove unnecessary access
• Review existing data source configurations for any signs of exploitation
• Implement network segmentation to limit PMM server exposure

Patch Information

Percona has addressed this vulnerability in PMM version 3.7.0. The fix involves restricting the privileges of the internal database user to prevent command execution capabilities. Organizations should upgrade to PMM 3.7.0 or later as soon as possible. Detailed release notes are available in the Percona PMM 3.7.0 Release Notes.

Workarounds

• Restrict pmm-admin access to only essential personnel until patching is complete
• Implement additional authentication controls such as MFA for PMM administrative access
• Place PMM servers behind a VPN or firewall to limit network accessibility
• Monitor and alert on any data source configuration changes as an interim detection measure

# Configuration example - Restrict network access to PMM
# Add firewall rules to limit PMM access to trusted networks only
iptables -A INPUT -p tcp --dport 443 -s <trusted_network>/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Review current data sources for suspicious entries
pmm-admin list --json | grep -i "data_source"