Loading feed…
Percona Blog0 Hot0 comments2 min read
Security Advisory: Privileged ClickHouse access through the Grafana data source in PMM
Percona Monitoring and Management (PMM) versions 3.9.0 and below have a high-severity vulnerability in the Grafana ClickHouse data source. Signed-in Grafana users, including Viewers, and unauthenticated users if anonymous access is enabled, can submit arbitrary SQL because the data source connects to ClickHouse using a default identity with global DDL, DML, and SOURCES privileges plus outbound HTTP access. On AWS EC2 deployments with IMDSv1 and anonymous access enabled, this can be chained to reach instance metadata, obtain an EC2 role session, read a Terraform remote-state file from S3, and authenticate as the PMM/Grafana administrator. Arbitrary SQL execution affects all deployments regardless of configuration. A fix ships in PMM 3.9.1, released August 19, 2026; a mitigation script is provided to create a least-privilege ClickHouse user for Grafana until upgrading is possible.
Source: https://www.percona.com/blog/security-advisory-cve-affecting-pmm. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.
