ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-22248

The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database

Published May 13, 2025 · catalog updated May 13, 2025 · VMware Bitnami

Check this week

CVE-2025-22248 is not in CISA KEV. FIRST estimates a 50.00% chance of exploitation in the next 30 days. Check whether you run VMware Bitnami.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.4
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
50.00%
Remediation
Version ranges on file
Affected products
vendor VMware Bitnami * <16.0.0

The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha K

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor VMware Bitnami * <16.0.0* <16.0.0

How to fix CVE-2025-22248

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2025-22248 is not in CISA KEV. FIRST estimates a 50.00% chance of exploitation in the next 30 days. Check whether you run VMware Bitnami.

Which versions are affected?

Compare what you have installed with VMware Bitnami * <16.0.0 * <16.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 50.00%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Docker securityKubernetes securityPostgreSQL security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 13, 2025 · EUVD

    Detected

    The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database usi

  2. May 13, 2025 · EUVD

    Updated

    The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database usi

Sources

  • CVE.orgVulnerability recordCVE-2025-22248

    Official CVE identifier

    cve.org
  • EUVDVulnerability recordEUVD-2025-14374

    The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streami

    euvd.enisa.europa.eu

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.