Percona vulnerabilities
We track 5 vulnerabilities in Percona products across 4 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on April 2, 2026.
Latest Percona vulnerabilities
- 9.9 Critical severity
Monitoring And Management: Execution with Unnecessary Privileges
An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell command
- 10.0 Critical severity
Monitoring and Management: Use of Default Password
An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.o
- 7.5 High severity
percona-toolkit: Use of Password Hash With Insufficient Computational Effort
Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona-toolkit: 3.6.0.
- 7.8 High severity
Xtrabackup: Improper Neutralization of Special Elements used in a Command
In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands.
- 9.8 Critical severity
Monitoring And Management: Improper Limitation of a Pathname to a Restricted Directory
In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted PO