CVE-2026-47847: Hardcoded Replication Credentials in Bitnami MariaDB Galera

Technical summary

CVE-2026-47847 is a hardcoded credential vulnerability (CWE-798) affecting Bitnami's MariaDB Galera container images and Helm chart. The MARIADB_REPLICATION_USER and MARIADB_REPLICATION_PASSWORD environment variables default to 'monitor' and 'monitor' respectively, granting REPLICATION CLIENT privileges from any host ('%'). The Helm chart does not expose configuration parameters to override these credentials, forcing all default deployments to use the same well-known pair. Affected releases span versions 10.6, 10.11, 11.4, 11.8, and 12.3 of the container image (prior to specific patch versions noted) and Helm chart versions prior to 18.3.0.

Business impact

Organizations relying on Bitnami's MariaDB Galera Helm chart for cloud-native database deployments face credential compromise at scale. The replication user, while limited to replication operations, could be abused to disrupt cluster health monitoring, extract topology information, or serve as a pivot point in multi-stage attacks. In environments where Galera clusters handle production workloads, compromised replication visibility undermines operational resilience and may violate security baselines for credential management.

Affected systems

Bitnami MariaDB Galera container images: 10.6.x before 10.6.27-photon-5-r0; 10.11.x before 10.11.17-photon-5-r1; 11.4.x before 11.4.12-photon-5-r0; 11.8.x before 11.8.7-photon-5-r1; 12.3.x before 12.3.2 (photon-5-r0 and debian-12-r0). Bitnami MariaDB Galera Helm chart: all versions prior to 18.3.0. This affects Kubernetes deployments, container orchestration platforms, and any direct use of the affected container images.

Exploitability

Exploitability is straightforward given the publicly known credential. An attacker with network access to a MariaDB Galera cluster (or replication port exposure) can authenticate directly using the default monitor/monitor credentials. No complex exploitation chain is required; the vulnerability exists at deployment time. However, the replication user's privileges are scoped to REPLICATION CLIENT operations, limiting the scope of direct database compromise. The CVSS score of 5.3 (Medium) reflects low-barrier network access and information disclosure risk, offset by limited scope of granted privileges.

Remediation

Upgrade to patched Bitnami container images and Helm chart version 18.3.0 or later. After upgrading the Helm chart, configure custom replication user credentials via the now-exposed environment variables or Helm values. For existing deployments, immediately override the default replication credentials by setting MARIADB_REPLICATION_USER and MARIADB_REPLICATION_PASSWORD to strong, unique values during container initialization or via Kubernetes secrets. Verify that network policies restrict access to Galera replication ports (typically 3306, 4567, 4568, 4444) to trusted cluster members only.

Patch guidance

1. Update Bitnami Helm chart to version 18.3.0 or later via your Helm repository. 2. For container images, upgrade to: 10.6.27-photon-5-r0 or later; 10.11.17-photon-5-r1 or later; 11.4.12-photon-5-r0 or later; 11.8.7-photon-5-r1 or later; or 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0 or later. 3. Test patched versions in a non-production environment first, as Helm chart updates may require value migrations. 4. Redeploy clusters using the patched chart and provide strong custom credentials for the replication user. 5. Verify backward compatibility with existing persistent data before rolling out to production.

Detection guidance

Monitor for authentication attempts to MariaDB using the username 'monitor' from unexpected sources. Check Kubernetes API audit logs for Helm chart deployments with versions prior to 18.3.0. Inspect running Galera pods for the absence of custom MARIADB_REPLICATION_USER and MARIADB_REPLICATION_PASSWORD environment variables (indicating reliance on defaults). Query MariaDB error logs for repeated connection attempts on replication ports using the default credential. In containerized environments, scan image tags and digests against the vulnerable version ranges listed above.

Why prioritize this

Although the CVSS score is Medium (5.3), prioritize this vulnerability in your Galera deployment roadmap because: (1) it is a default-on credential vulnerability affecting all standard deployments; (2) the credential is public and trivial to exploit; (3) replication access, while scoped, can expose cluster topology and state; (4) remediation is straightforward (Helm upgrade + credential override) and low-risk; (5) Galera clusters often run production data, making credential compromise a compliance concern.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) is derived from Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), Privileges Required: None (PR:N), User Interaction: None (UI:N), Scope: Unchanged (S:U), Confidentiality: Low (C:L), Integrity: None (I:N), Availability: None (A:N). The score reflects that the vulnerability is easily exploitable over the network with no barriers, but the impact is limited to low-level information disclosure (replication status, cluster state) with no direct integrity or availability loss. The replication user cannot modify data or shut down the database, capping the severity despite the default-credential weakness.

Frequently asked questions