AI description
CVE-2025-41240 affects certain Bitnami Helm charts. The vulnerability stems from the charts mounting Kubernetes Secrets under a predictable path, specifically `/opt/bitnami/*/secrets`, which is located within the web server document root. In the affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could potentially retrieve these secrets by accessing specific URLs if the application is exposed externally. This issue specifically impacts deployments using the default setting `usePasswordFiles=true`, which results in secrets being mounted as files within the container's file system.
- Description
- Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets by accessing specific URLs if the application is exposed externally. The issue affects deployments using the default value of usePasswordFiles=true, which mounts secrets as files into the container filesystem.
- Source
- security@vmware.com
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 10
- Impact score
- 6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-552
- Hype score
- Not currently trending
🟥 CVE-2025-41240, CVSS: 10.0 (#Critical, #Highest) Bitnami Helm charts, #VMware. Vulnerability allows unauthenticated access to sensitive Kubernetes Secrets via predictable paths in the web server document root. Affected deployments use the default setting of https://t.co
@UjlakiMarci
24 Jul 2025
2513 Impressions
14 Retweets
30 Likes
14 Bookmarks
1 Reply
0 Quotes
[CVE-2025-41240: CRITICAL] Vulnerable Bitnami Helm charts expose sensitive credentials on Kubernetes under /opt/bitnami/*/secrets in web server root, leading to unauthenticated access risks.#cve,CVE-2025-41240,#cybersecurity https://t.co/nN2e1lU444 https://t.co/vNj7Z5mG0m
@CveFindCom
24 Jul 2025
91 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes