Executive brief
Bitnami MariaDB Galera, a database solution used for high-availability data storage, was found to use a publicly known default username and password for its replication health-check service. An unauthorized person with network access to the database could use these credentials to view sensitive information about the database's internal structure and configuration. This could allow an attacker to map out the network or identify further weaknesses in the database cluster.
Technical details
A hardcoded credentials vulnerability (CWE-798) exists in Bitnami MariaDB Galera container images and Helm charts. The environment variables MARIADB_REPLICATION_USER and MARIADB_REPLICATION_PASSWORD default to 'monitor' and 'monitor' respectively, and the Helm chart lacked parameters to override these values. This user is granted REPLICATION CLIENT privileges from any host ('%'). A remote, unauthenticated attacker with network access to the MariaDB port (default 3306) can authenticate and execute commands like 'SHOW REPLICA STATUS' to retrieve cluster topology, primary host details, and binary log positions. The issue is fixed in Helm chart 18.3.0 and various container image updates which now support random password generation or explicit configuration.
Affected products
- Bitnami MariaDB Galera container image < 10.6.27-photon-5-r0, < 10.11.17-photon-5-r1, < 11.4.12-photon-5-r0, < 11.8.7-photon-5-r1, < 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0
- Bitnami MariaDB Galera Helm chart < 18.3.0
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
- 2026-06-18: patched