N A EUVD-2026-18364

Attacker must possess valid pmm-admin role credentials-a privileged administrative account within Percona PMM with rights to manage data sources and monitoring configurations. Exploitation requires network access to the PMM web interface or API (CVSS AV:N), but authentication barrier (PR:L) limits attack surface to credential holders or scenarios where pmm-admin accounts have been compromised through separate attacks. No user interaction required (UI:N) once authenticated. Vulnerability is exploitable against default PMM configurations prior to version 3.7 without requiring non-standard feature enablement. Exploitation is limited by: necessity of pre-existing privileged credentials, network accessibility policies to PMM server, and logging/monitoring that may detect anomalous data source creation activity. The scope change (S:C) in CVSS vector indicates exploitation breaks containment boundaries between database and OS contexts.

CVSS 9.9 (Critical) reflects the severe technical impact: network-accessible (AV:N), low complexity (AC:L), scope change (S:C) enabling container breakout, and complete CIA triad compromise. However, real-world risk is significantly moderated by authentication requirements (PR:L) demanding pmm-admin credentials-a privileged operational role not held by typical users. EPSS probability of 0.04% (13th percentile) indicates attackers are not actively targeting this vulnerability in the wild, corroborated by CISA SSVC showing zero exploitation activity and non-automatable characteristics. The SSVC 'total technical impact' rating acknowledges the complete system compromise potential post-authentication. This creates a risk paradox: devastating impact if exploited, but limited attack surface requiring insider access or credential compromise. Priority depends on PMM deployment context-high risk in environments where pmm-admin credentials are broadly distributed or inadequately protected, lower risk where admin access follows least-privilege principles. The gap between CVSS severity and EPSS probability suggests this is more relevant for insider threat scenarios than opportunistic mass exploitation.

An attacker with previously obtained pmm-admin credentials (through phishing, credential stuffing, or insider access) authenticates to the Percona PMM web interface. They navigate to the 'Add data source' feature and craft a malicious data source configuration containing shell metacharacters or command injection payloads. When PMM processes this input using the over-privileged internal database user, the injected commands execute at the operating system level with the privileges of the PMM service account, granting the attacker shell access to the monitoring server. From this foothold, the attacker can pivot to monitored database systems, exfiltrate credentials stored in PMM configuration, or establish persistence on the infrastructure.