A hardcoded default credential is applied to the Galera replication health‑check user in Bitnami MariaDB Galera container images and Helm chart. The user is created with the nickname "monitor" and password "monitor" and is granted REPLICATION CLIENT privileges from any network host. This flaw allows an attacker to authenticate as a user with replication monitoring rights and thereby read replication status. Based on the description, it is inferred that an attacker could enumerate cluster nodes or gather metadata for subsequent attacks.

The vulnerability affects Bitnami MariaDB Galera builds and the related Helm chart. Containers built on versions 10.6.x prior to 10.6.27-photon-5-r0, 10.11.x prior to 10.11.17-photon-5-r1, 11.4.x prior to 11.4.12-photon-5-r0, 11.8.x prior to 11.8.7-photon-5-r1, and 12.3.x prior to 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0 are affected. The Helm chart prior to version 18.3.0 also deploys the vulnerable default credentials.

With a CVSS base score of 5.3 the vulnerability presents moderate risk. The EPSS score is not available, but the flaw is publicly documented and static, providing an attacker with easily guessable credentials. The vulnerability is not listed in CISA's KEV catalog, so no known mass exploitation has been reported yet. Attackers could gain replication client access from any host. Exploitation requires only network connectivity to the MariaDB service and the use of the default credentials.