Executive Summary

CVE-2026-47847 is a moderate severity vulnerability in Bitnami MariaDB Galera container images and Helm charts caused by hardcoded default credentials for the Galera replication health-check user.

The username and password for this user are both set to "monitor" by default, and this user has REPLICATION CLIENT privileges from any host, allowing remote attackers with network access to the MariaDB port to authenticate using these known credentials.

Because the Bitnami Helm chart did not expose parameters to configure these credentials, all deployments used this publicly known credential by default.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers with network access to the MariaDB port (default 3306) to authenticate as the replication health-check user using default credentials.

The attacker can then query replication topology and status information, potentially exposing cluster topology and replication configuration.

The impact is considered moderate with a CVSS score of 5.3, and it does not allow modification or deletion of data, but it can leak some information about the database replication setup.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the MariaDB Galera deployment is using the default replication health-check user credentials, which are username 'monitor' and password 'monitor'.

You can attempt to connect to the MariaDB service on port 3306 using these credentials to verify if the default user is active and accessible.

For example, you can use the following command to test authentication and query replication status:

• mysql -h <mariadb_host> -P 3306 -u monitor -pmonitor -e "SHOW STATUS LIKE 'wsrep_%';"

If the command succeeds, it indicates the default credentials are still in use and the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the affected Bitnami MariaDB Galera container images or Helm charts to the fixed versions.

• Upgrade container images to versions 10.6.27-photon-5-r0 or later, 10.11.17-photon-5-r1 or later, 11.4.12-photon-5-r0 or later, 11.8.7-photon-5-r1 or later, and 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0 or later.
• Upgrade Helm charts to version 18.3.0 or later.

Additionally, set strong, unique passwords for the replication user instead of the default 'monitor' password.

Restrict network access to the MariaDB port (default 3306) to trusted hosts only.

Rotate existing replication user passwords to prevent unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves hardcoded default credentials that allow remote attackers to authenticate and query replication topology and status information. This could lead to unauthorized access to certain database information.

Such unauthorized access may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and control over access to systems. Exposure of replication topology and status information could be considered a confidentiality risk under these regulations.

Mitigation steps such as upgrading to fixed versions, setting strong unique passwords, restricting network access, and rotating passwords are necessary to reduce the risk and help maintain compliance.

Useful 0 Not Useful 0