CVE-2025-41240: Mounted Kubernetes Secrets under a predictable path located within the web server document root
Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami//secrets) that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets by accessing specific URLs if the application is exposed externally. The issue affects deployments using the default value of usePasswordFiles=true, which mounts secrets as files into the container filesystem.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41240?
CVE-2025-41240 is considered a high-severity vulnerability due to the potential for unauthorized access to sensitive credentials.
How do I patch CVE-2025-41240?
To patch CVE-2025-41240, update to the latest version of the affected Bitnami Helm charts where the issue has been resolved.
What are the implications of CVE-2025-41240?
CVE-2025-41240 allows unauthenticated access to sensitive secrets, risking data exposure and potential exploitation.
Which versions of Bitnami Helm charts are affected by CVE-2025-41240?
CVE-2025-41240 impacts specific versions of Bitnami Helm charts that mount Kubernetes Secrets in a predictable web server document root path.
Can CVE-2025-41240 be exploited remotely?
Yes, CVE-2025-41240 can be exploited remotely by attackers to retrieve sensitive credentials if the vulnerable charts are deployed.