54 matches found
MAL-2025-15763 Malicious code in bitnami-helpers (npm)
The package bitnami-helpers was found to contain malicious code...
Malicious code in bitnami-helpers (npm)
The package bitnami-helpers was found to contain malicious code...
PT-2025-31491 · Bitnami · Golang
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS e.g. Git, but contains metadata for another VCS e.g. Mercurial...
CVE-2025-41240
Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path /opt/bitnami//secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets ...
CVE-2025-41240
Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path /opt/bitnami//secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets ...
CVE-2025-41240
CVE-2025-41240 involves Bitnami Helm charts mounting Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) inside the web server document root. Affected deployments using the default usePasswordFiles=true may expose secrets via HTTP/S when the application is externally accessible, ...
CVE-2025-41240 Mounted Kubernetes Secrets under a predictable path located within the web server document root
Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path /opt/bitnami//secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets ...
CVE-2025-41240 Mounted Kubernetes Secrets under a predictable path located within the web server document root
Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path /opt/bitnami//secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets ...
BIT-WORDPRESS-2025-41240
The Bitnami WordPress Helm chart mounts Kubernetes Secrets under a predictable path /opt/bitnami/wordpress/secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrie...
BIT-DRUPAL-2025-41240
The Bitnami Drupal Helm chart mounts Kubernetes Secrets under a predictable path /opt/bitnami/drupal/secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve the...
BIT-APPSMITH-2025-41240
The Bitnami Appsmith Helm chart mounts Kubernetes Secrets under a predictable path /opt/bitnami/appsmith/secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve...
PT-2025-30604 · Bitnami · Appsmith +2
Name of the Vulnerable Software and Affected Versions: Bitnami Appsmith Helm chart affected versions not specified Bitnami WordPress Helm chart affected versions not specified Bitnami Drupal Helm chart affected versions not specified Description: The Helm charts for Bitnami Appsmith, WordPress, a...
CVE-2021-21979
In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker image bitnami/laravel was built, and the value of APPKEY ...
CVE-2025-22248
The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOLSRCHECKUSER is the user that Pgpool itself uses to perform streaming replication check...
CVE-2025-22248
The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOLSRCHECKUSER is the user that Pgpool itself uses to perform streaming replication check...
CVE-2025-22248 [pgpool] Unauthenticated access to postgres through pgpool
The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOLSRCHECKUSER is the user that Pgpool itself uses to perform streaming replication check...
CVE-2025-22248
CVE-2025-22248 affects the Bitnami pgpool image and Bitnami Postgres-HA chart. In default configurations, a repmgr user exists inside the cluster that allows unauthenticated access to PostgreSQL; PGPOOL_SR_CHECK_USER is used for streaming replication checks and should not be trusted. If Pgpool is...
CVE-2025-22248 [pgpool] Unauthenticated access to postgres through pgpool
The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOLSRCHECKUSER is the user that Pgpool itself uses to perform streaming replication check...
BIT-PGPOOL-2025-22248
The PgPool II component into a Bitnami Pgpool II container image comes by default configured with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. This can be addressed by mounting and overwriting the Pgpool configuration file directly. If PgPool is exposed...
