Percona PMM Authenticated Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Percona Monitoring and Management (PMM) versions prior to 3.7. This issue arises because an internal database user retains certain superuser privileges. An attacker with pmm-admin rights can exploit the 'Add data source' feature to escape the database context and execute shell commands on the underlying operating system.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server where PMM is running.

Remediation

Users can upgrade to Percona PMM version 3.7.0 or later, where this vulnerability has been fixed.