CVE-2026-47847 describes a vulnerability in Bitnami's mariadb-galera container images and Helm chart where the Galera replication health-check user is configured with hardcoded default credentials (username and password both set to 'monitor'). This user is granted REPLICATION CLIENT privileges from any host ('%'), allowing potential unauthorized access to replication status information. The Helm chart prior to version 18.3.0 did not expose parameters to customize these credentials, resulting in widespread use of the default credentials. Affected container image versions include 10.6.x prior to 10.6.27-photon-5-r0, 10.11.x prior to 10.11.17-photon-5-r1, 11.4.x prior to 11.4.12-photon-5-r0, 11.8.x prior to 11.8.7-photon-5-r1, and 12.3.x prior to 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0.

The vulnerability allows an attacker with network access to the MariaDB Galera instance to authenticate using the hardcoded replication user credentials, which have REPLICATION CLIENT privileges. This could lead to unauthorized access to replication status information. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality but not integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The information indicates fixed versions exist (e.g., 10.6.27-photon-5-r0 and later), but no explicit patch links or official remediation level are provided. Users should upgrade to the fixed container image versions and Helm chart version 18.3.0 or later once available. Until patched, users should avoid deploying default Helm charts without customizing replication user credentials if possible.