CVE-2026-47847 identifies a vulnerability in Bitnami's mariadb-galera container images and Helm chart where the Galera replication health-check user is configured with hardcoded default credentials (username and password both set to 'monitor'). This user is granted REPLICATION CLIENT privileges from any host ('%'), allowing potential unauthorized access to replication status information. The Helm chart lacked parameters to customize these credentials, resulting in widespread deployments using the default, publicly known credentials. Affected versions include container images in the 10.6.x, 10.11.x, 11.4.x, 11.8.x, and 12.3.x series prior to the specified fixed releases, and Helm chart versions before 18.3.0.

The vulnerability allows an attacker to connect to the MariaDB Galera cluster using the hardcoded replication health-check user credentials, which have REPLICATION CLIENT privileges. This could enable unauthorized access to replication status information but does not grant data modification or denial of service capabilities. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches or updated Helm charts are applied, users should avoid deploying affected versions or manually change the replication user credentials if possible. Monitor vendor communications for updates and apply upgrades to container images 10.6.27-photon-5-r0 or later, 10.11.17-photon-5-r1 or later, 11.4.12-photon-5-r0 or later, 11.8.7-photon-5-r1 or later, 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0 or later, and Helm chart version 18.3.0 or later once available.