MySQL Service Summary fails with ERROR 1045 when password contains shell-special characters (e.g. `&`) — regression from PMM 2 to PMM 3.9.1

[Simakink]

Description

After upgrading from PMM 2 to PMM 3.9.1, the Service Summary action for a
MySQL service fails with ERROR 1045 (28000): Access denied for user 'pmm_observer'@'localhost' (using password: YES) — even though the exact same
pmm_observer credentials worked fine in PMM 2 and still connect successfully
from a MySQL client.

The failure is specific to passwords containing shell-special characters
(e.g. &). Replacing the password with one that has no such characters makes
Service Summary work again. The MySQL exporter / monitoring metrics continue to
work with the same account, so the stored credentials themselves are valid.

Expected Results

Service Summary succeeds, as it did in PMM 2 with the same credentials.

Investigation / root-cause analysis

• Running the bundled pt-mysql-summary manually with the password properly quoted succeeds:
  pt-mysql-summary --user=pmm_observer --password='pa&ss' --host=localhost # works
• The bundled tool is the bash port of pt-mysql-summary (reports pt-mysql-summary 3.7.1), located at /usr/local/percona/pmm/tools/pt-mysql-summary inside the pmm-server container.
• Tracing the actual tool execution (every mysql invocation with password pa&ss) shows the tool forwards the argument intact — & is not mangled by the script, since POSIX-shell variable expansion does not re-interpret & as an operator.
• Conclusion: the password is truncated before it reaches the tool — the actions runner appears to build the command as a single shell string and execute it through a shell without quoting/escaping the password. --password=pa&ss gets split by the
  shell into --password=pa, a background job, and a stray token, so the client sends a wrong (truncated) password → ERROR 1045 ... (using password: YES). A password without metacharacters works for the same reason.

Actual Results

ERROR 1045 (28000): Access denied for user 'pmm_observer'@'localhost' (using password: YES)
2026_09_03_11_54_04 Cannot connect to MySQL. Check that MySQL is running and that the options after -- are correct.
PMM server log:
time="2026-09-03T12:46:22.515+03:00" level=warning msg="Action terminated with error: exit status 1" component=runner id=... type=/usr/local/percona/pmm/tools/pt-mysql-summary

Version

pmm-agent 3.9.1
pmm-server 3.9.1

Steps to reproduce

Steps to reproduce

1. Create the monitoring user with a password containing a shell
   metacharacter, e.g.:

   CREATE USER 'pmm_observer'@'localhost' IDENTIFIED BY 'pa&ss';
   GRANT SELECT, PROCESS, REPLICATION CLIENT, ... ON *.* TO 'pmm_observer'@'localhost';

2. Add the MySQL service to PMM (works in PMM 2).

3. Upgrade to PMM 3.9.1.

4. Open the service and run Service Summary (MySQL).

5. The action fails with the access-denied error below.

Actual behavior

MySQL client error, followed by the bundled tool failing:

ERROR 1045 (28000): Access denied for user 'pmm_observer'@'localhost' (using password: YES)
2026_09_03_11_54_04 Cannot connect to MySQL.  Check that MySQL is running and that the options after -- are correct.

PMM server log:

time="2026-09-03T12:46:22.515+03:00" level=warning msg="Action terminated with error: exit status 1" component=runner id=... type=/usr/local/percona/pmm/tools/pt-mysql-summary

Relevant logs

Code of Conduct

• I agree to follow Percona Community Code of Conduct