High-Severity Percona PMM Advisory: Privileged ClickHouse Access Exposed Through the Grafana Data Source
If you run Percona Monitoring and Management (PMM) to keep an eye on MySQL, PostgreSQL, MongoDB, or ClickHouse workloads, this week brought news you cannot ignore. On August 19, 2026, Percona published a high-severity security advisory affecting PMM versions 3.9.0 and below, scoring 8.7 on the CVSS scale. The flaw lives at the junction between PMM’s Grafana front end and its internal ClickHouse instance: people who should only ever see dashboards can, under certain configurations, submit raw SQL against the datastore behind them with far more power than any chart requires. In the worst case, an outsider with no credentials at all can pivot from a public Grafana page into live cloud credentials and your infrastructure state files. Here is what changed, who is exposed, and how to respond.
Related ServerSpan guide: CUPS RCE on Linux VPS: CVE-2026-34980 Chains to Root — Check If You Are Exposed Right Now.
What the Vulnerability Actually Is
PMM ships Grafana as its visualization layer, and that is where the problem starts. According to Percona’s advisory, PMM’s Grafana instance allows signed-in users — including those holding only the Viewer role — to call raw data source APIs directly. That matters because the Viewer role is typically handed out generously: junior engineers, contractors, application teams who just want read-only visibility into query latency or replication lag.
Worse, if anonymous access has been explicitly enabled on the Grafana instance, even unauthenticated visitors can reach these same APIs. Percona stresses that anonymous access is off by default, so the most dangerous scenario requires a deliberate configuration choice — but plenty of internal-facing deployments enable it for convenience.
Through the Grafana ClickHouse data source, such a user can submit arbitrary SQL. Critically, the data source connects to ClickHouse as the default identity — an account holding global DDL, DML, and SOURCES privileges, plus the ability to make outbound HTTP requests. In practical terms, the blast radius is not limited to reading metrics. An attacker can alter schemas, write or delete data, and use ClickHouse’s outbound request capability to probe systems the PMM server can reach internally.
One caveat worth flagging: the CVE identifier is still pending. Percona states the advisory will be updated once the number is assigned, so track the original post rather than relying on third-party summaries alone.
From Dashboard Login to Cloud Credentials: Why the Chain Matters
Individually, each piece of this vulnerability is uncomfortable. Chained together, it becomes a genuine breach path. Percona describes a sequence in which an attacker can reach AWS IMDSv1, obtain a live EC2 role session, read a Terraform remote-state object from S3, and ultimately authenticate as the PMM/Grafana administrator.
For readers less familiar with the moving parts: the Instance Metadata Service (IMDS) on an EC2 instance hands out temporary credentials tied to that machine’s IAM role. IMDSv1 does not require a session token, so any process on the box that can issue HTTP requests — including ClickHouse via its outbound functions — can ask for them. Those credentials are renewable while active, meaning an attacker does not get a one-time key; they get a persistent session into whatever the IAM role permits.
From there, many teams store Terraform state remotely, and state files routinely embed live secrets: database passwords, API tokens, private endpoint addresses. A single readable state object can hand over dozens of independently reusable credentials along with a map of your private infrastructure. The final step closes the loop — authenticating as the PMM administrator gives the attacker standing control over the monitoring plane itself.
Two important qualifiers. First, Percona explicitly notes that impact severity depends on deployment configuration, and the full IMDS-to-credential chain requires anonymous access to be enabled plus additional server-side conditions spelled out in the full advisory — review that document for your exact exposure. Second, even without anonymous access, the raw-API path remains available to any signed-in Viewer-role user, so a compromised low-privilege account is still a serious starting point.
Fixing It Now: Upgrade First, Restrict Privileges Second
Percona’s recommended permanent fix is straightforward: upgrade PMM to a non-impacted version. Treat this as priority patching, not routine housekeeping. As with any upgrade touching a monitoring stack, schedule a brief maintenance window, snapshot the environment first, and re-verify that agents report in cleanly afterward.
If an immediate upgrade is not feasible, Percona offers an interim mitigation: a script that creates a least-privilege ClickHouse user for Grafana, closing the exploitation path without waiting for the new build. Before you run it, two steps are non-negotiable per the advisory:
- Back up the PMM Server.
- Save the pmm-data volume.
This is not bureaucratic caution. You are changing the identity Grafana uses to talk to ClickHouse — the backbone of every dashboard you rely on. If something misbehaves after the change, a rollback path is the difference between a five-minute recovery and rebuilding your monitoring history from scratch. After applying either fix, spot-check key dashboards, confirm queries still execute, and verify nothing custom depended on the old identity’s elevated rights.
Hardening Lessons for Self-Hosted Monitoring Stacks
Even teams not running PMM should read this advisory as a case study, because the pattern repeats across self-hosted admin panels and observability tooling:
For a more detailed walkthrough of this part of the topic, read Server Monitoring on Your VPS: Self-Hosted Uptime and Health Monitoring for Developers.
- Anonymous access stays off. Convenience features on management surfaces are attack surface. If a dashboard must be public, proxy it through a read-only, purpose-built view instead.
- Service accounts deserve least privilege. A data source connecting as an identity with global DDL and DML rights exists for vendor convenience, not yours. Scope what each component can actually do.
- Outbound HTTP from databases is a pivoting tool. Treat any database feature that issues external requests as a potential SSRF vector toward metadata services and internal APIs.
- IMDS hygiene matters. Where your platform supports it, prefer token-based metadata access and keep IAM roles scoped narrowly, so a foothold on one instance does not cascade.
- Terraform remote state is a secrets vault. Encrypt it, lock down the bucket policy, and rotate anything you would not want exposed in plaintext.
- Patch the watchers. Your monitoring stack sees everything your production stack does — and frequently holds the credentials to prove it. It belongs on your critical patch cadence.
Key Takeaways
- Confirm your PMM version; anything 3.9.0 and below is impacted (CVSS 8.7, High).
- Schedule the upgrade to a non-impacted release as soon as operationally possible.
- Before any interim mitigation, back up the PMM Server and save the pmm-data volume.
- If you cannot upgrade immediately, apply Percona’s least-privilege ClickHouse user script.
- Verify anonymous access is disabled and audit who currently holds Viewer-role accounts.
- Review IAM roles and metadata service configuration on hosts running PMM.
- Lock down access to Terraform state buckets and rotate embedded secrets.
- Monitor the Percona advisory for the pending CVE identifier and follow-up guidance.
Monitoring tools earn trust by sitting close to your most sensitive data, and this advisory shows how quickly that proximity becomes a liability when privilege boundaries blur. The good news is that Percona moved quickly, disclosed clearly, and shipped both a permanent fix and a workable stopgap. The bad news is that none of that helps until you act. Check your version today, take the backup, and close the gap — before someone else finds your Grafana page first.