CVE-2026-47847

{
  "id": "CVE-2026-47847",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-18T20:16:13.740",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user. The MARIADB_REPLICATION_USER and MARIADB_REPLICATION_PASSWORD environment variables defaulted to monitor and monitor respectively. This user is granted REPLICATION CLIENT privileges from any host ('%'). The Bitnami Helm chart for MariaDB Galera did not expose parameters to configure this user's credentials, resulting in all chart deployments using this publicly known credential by default.\n\nAffected versions — Container image: 10.6.x prior to 10.6.27-photon-5-r0; 10.11.x prior to 10.11.17-photon-5-r1; 11.4.x prior to 11.4.12-photon-5-r0; 11.8.x prior to 11.8.7-photon-5-r1; 12.3.x prior to 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0. Helm chart: prior to 18.3.0."
    },
    {
      "lang": "es",
      "value": "Las imágenes de contenedor Bitnami MariaDB Galera y el chart de Helm están afectadas por una vulnerabilidad de credenciales predeterminadas codificadas en el usuario de verificación de estado de replicación de Galera. Las variables de entorno MARIADB_REPLICATION_USER y MARIADB_REPLICATION_PASSWORD se establecieron por defecto en ’monitor’ y ’monitor’ respectivamente. A este usuario se le otorgan privilegios de REPLICATION CLIENT desde cualquier host (’%’). El chart de Helm de Bitnami para MariaDB Galera no exponía parámetros para configurar las credenciales de este usuario, lo que resultaba en que todas las implementaciones del chart utilizaran esta credencial públicamente conocida por defecto.\n\nVersiones afectadas - Imagen de contenedor: 10.6.x anteriores a 10.6.27-photon-5-r0; 10.11.x anteriores a 10.11.17-photon-5-r1; 11.4.x anteriores a 11.4.12-photon-5-r0; 11.8.x anteriores a 11.8.7-photon-5-r1; 12.3.x anteriores a 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0. Chart de Helm: anteriores a 18.3.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Bitnami",
          "product": "bitnami/mariadb-galera",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "10.6.0",
              "lessThan": "10.6.27-photon-5-r0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "10.11.0",
              "lessThan": "10.11.17-photon-5-r1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "11.4.0",
              "lessThan": "11.4.12-photon-5-r0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "11.8.0",
              "lessThan": "11.8.7-photon-5-r1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "12.3.0",
              "lessThan": "12.3.2-photon-5-r0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Bitnami",
          "product": "bitnami/mariadb-galera Helm chart",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "18.3.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-18T20:24:19.143214Z",
          "id": "CVE-2026-47847",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/bitnami/containers/security/advisories/GHSA-xcv9-cg8m-3mf2",
      "source": "[email protected]"
    }
  ]
}