This vulnerability in Percona PMM before version 3.7 involves improper privilege management where an internal database user retains superuser rights. An attacker possessing pmm-admin privileges can abuse the "Add data source" functionality to escape the database sandbox and execute shell commands on the host OS. This represents a critical security flaw allowing full system compromise through privilege escalation and command injection. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges at the pmm-admin level, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with pmm-admin privileges to execute arbitrary shell commands on the underlying operating system, leading to full system compromise. This affects confidentiality, integrity, and availability of the affected system. The vulnerability is critical with a CVSS score of 9.9. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict pmm-admin privileges to trusted users only and monitor for suspicious activity related to the "Add data source" feature. Avoid exposing Percona PMM interfaces to untrusted networks or users.