What is the CVSS score of CVE-2026-47847?

CVE-2026-47847 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47847?

Yes, a patch is available for CVE-2026-47847. Update the affected software to the latest version immediately.

Bitnami MariaDB Galera CVE-2026-47847

EUVD-2026-37931 MEDIUM

Use of Hard-coded Credentials (CWE-798)

2026-06-18 vmware

Debian Authentication Bypass Bitnami Mariadb Galera Bitnami Mariadb Galera Helm Chart

5.3

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Publicly known credentials negate the authentication barrier (PR:N, AC:L); REPLICATION CLIENT access yields read-only replication metadata, not table data (C:L, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 18, 2026 - 21:02 EUVD

Analysis Generated

Jun 18, 2026 - 20:01 vuln.today

DescriptionCVE.org

Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user. The MARIADB_REPLICATION_USER and MARIADB_REPLICATION_PASSWORD environment variables defaulted to monitor and monitor respectively. This user is granted REPLICATION CLIENT privileges from any host ('%'). The Bitnami Helm chart for MariaDB Galera did not expose parameters to configure this user's credentials, resulting in all chart deployments using this publicly known credential by default.

Affected versions - Container image: 10.6.x prior to 10.6.27-photon-5-r0; 10.11.x prior to 10.11.17-photon-5-r1; 11.4.x prior to 11.4.12-photon-5-r0; 11.8.x prior to 11.8.7-photon-5-r1; 12.3.x prior to 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0. Helm chart: prior to 18.3.0.

AnalysisAI

Hardcoded default credentials in Bitnami MariaDB Galera container images and Helm chart expose all default deployments to unauthenticated replication status enumeration over the network. The health-check user monitor with password monitor is granted REPLICATION CLIENT privileges from any host (%), meaning any network-accessible cluster running affected images (10.6.x through 12.3.x) or Helm chart prior to 18.3.0 can be accessed using these publicly known credentials. The Helm chart structurally prevented operators from overriding these credentials at deploy time, making the exposure pervasive across all standard chart-based deployments; no public exploit has been identified and the vulnerability is not in CISA KEV at time of analysis.

Technical ContextAI

CWE-798 (Use of Hard-coded Credentials) manifests here through Bitnami's containerized packaging of MariaDB Galera Cluster, a synchronous multi-master replication plugin for MariaDB. Galera's health-check mechanism requires a dedicated database user with REPLICATION CLIENT privileges to monitor replication status via commands such as SHOW MASTER STATUS and SHOW SLAVE STATUS. Bitnami hard-coded this user as monitor with password monitor and granted it from the wildcard host %, meaning any source IP is permitted to authenticate. The CPE entries (cpe:2.3:a:bitnami:bitnami/mariadb-galera and cpe:2.3:a:bitnami:bitnami/mariadb-galera_helm_chart) confirm the flaw spans both the container image artifact and the Helm chart packaging layer. Critically, the Helm chart prior to 18.3.0 exposed no Helm values to override MARIADB_REPLICATION_USER or MARIADB_REPLICATION_PASSWORD, leaving operators with no standard, declarative mechanism to rotate the credential without custom post-install scripting.

RemediationAI

The primary fix is to upgrade to patched container image tags - 10.6.27-photon-5-r0, 10.11.17-photon-5-r1, 11.4.12-photon-5-r0, 11.8.7-photon-5-r1, 12.3.2-photon-5-r0, or 12.3.2-debian-12-r0 - and to upgrade the Helm chart to version 18.3.0 or later, which introduces configurable Helm values for the replication user credentials. For existing deployments that cannot be immediately upgraded, operators should manually remediate by connecting to each cluster node and executing DROP USER 'monitor'@'%' followed by recreating the user with a strong, unique password, then updating any Galera health-check probes to use the new credential - note this requires coordinated changes across all cluster members and liveness/readiness probe configurations. As a network-layer compensating control, apply Kubernetes NetworkPolicy rules restricting access to MariaDB port 3306 to only trusted namespaces and service accounts, reducing the attacker pool even on unpatched nodes; the trade-off is operational overhead of maintaining fine-grained network policies. Full advisory and upgrade guidance: https://github.com/bitnami/containers/security/advisories/GHSA-xcv9-cg8m-3mf2.