Percona Monitoring and Management (PMM) versions 3.9.0 and below have a high-severity vulnerability in the Grafana ClickHouse data source. Signed-in Grafana users, including Viewers, and unauthenticated users if anonymous access is enabled, can submit arbitrary SQL because the data source connects to ClickHouse using a default identity with global DDL, DML, and SOURCES privileges plus outbound HTTP access. On AWS EC2 deployments with IMDSv1 and anonymous access enabled, this can be chained to reach instance metadata, obtain an EC2 role session, read a Terraform remote-state file from S3, and authenticate as the PMM/Grafana administrator. Arbitrary SQL execution affects all deployments regardless of configuration. A fix ships in PMM 3.9.1, released August 19, 2026; a mitigation script is provided to create a least-privilege ClickHouse user for Grafana until upgrading is possible.
Table of contents
SummaryVulnerability detailsImpactRemediationMitigationSupport & additional resourcesContactQuestions this post answers
What is the PMM vulnerability affecting the Grafana ClickHouse data source in PMM 3.9.0 and below?
Signed-in Grafana users, including those with only the Viewer role, can call raw data source APIs and submit arbitrary SQL through the ClickHouse data source, because it connects to ClickHouse using a default identity with global DDL, DML, and SOURCES privileges and outbound HTTP access. If anonymous access is enabled, unauthenticated users can reach it too. The issue is fixed in PMM 3.9.1, released August 19, 2026. Teams running PMM in production can track fixes like the 3.9.1 patch alongside other infrastructure security advisories on daily.dev.
How can an attacker escalate the PMM ClickHouse data source flaw into AWS credential theft?
By chaining the arbitrary SQL execution through outbound HTTP requests to reach AWS IMDSv1, an attacker can obtain a live EC2 role session, read a Terraform remote-state object from S3, and authenticate as the PMM or Grafana administrator. This full chain only applies when anonymous access is enabled and PMM Server runs on AWS EC2 with IMDSv1; arbitrary SQL execution itself affects all deployments. Engineers assessing blast radius from a data source flaw can follow related infrastructure security writeups on daily.dev.
How do I mitigate the PMM Grafana ClickHouse vulnerability before upgrading to 3.9.1?
Back up the PMM Server and the pmm-data volume, then run the provided mitigation script, which creates a least-privilege ClickHouse user for Grafana and repoints the ClickHouse data source to it, replacing the default superuser identity and closing the exploitation path until the upgrade to PMM 3.9.1 can be applied. Teams staging an urgent security patch can compare mitigation steps like this one on daily.dev before rolling out.