CVE-2026-25212 - Vulnerability Analysis

Overview

Percona PMM < 3.7 contains a command injection caused by abuse of the "Add data source" feature by an internal database user with superuser privileges, letting attackers with pmm-admin rights execute shell commands on the OS.

Severity & Score

Impact

Attackers with pmm-admin rights can execute arbitrary shell commands on the underlying operating system, leading to full system compromise.

Mitigation

Upgrade to version 3.7 or later.

References

• https://percona.com
• https://docs.percona.com/percona-monitoring-and-management/3/release-notes/3.7.0.html#authenticated-remote-code-execution-via-internal-data-source-cve-2026-25212

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner