The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.
References
| Link | Resource |
|---|---|
| https://github.com/bitnami/charts/security/advisories/GHSA-mx38-x658-5fwj | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
18 Jul 2025, 18:58
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Broadcom bitnami\/pgpool
|
|
| CPE | cpe:2.3:a:broadcom:bitnami\/pgpool:*:*:*:*:*:docker:*:* |
16 Jul 2025, 18:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:broadcom:bitnami:*:*:*:*:*:postgresql:*:* cpe:2.3:a:broadcom:bitnami_popool:*:*:*:*:*:docker:*:* |
|
| References | () https://github.com/bitnami/charts/security/advisories/GHSA-mx38-x658-5fwj - Vendor Advisory | |
| First Time |
Broadcom
Broadcom bitnami Popool Broadcom bitnami |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| Summary |
|
13 May 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1188 |
13 May 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-13 10:15
Updated : 2025-07-18 18:58
NVD link : CVE-2025-22248
Mitre link : CVE-2025-22248
CVE.ORG link : CVE-2025-22248
JSON object : View
Products Affected
broadcom
- bitnami
- bitnami\/pgpool
CWE
CWE-1188
Insecure Default Initialization of Resource