UNOFFICIAL/EXPERIMENTAL. Live receipt generated by scripts/run-default-credential-check.mjs; do not hand-edit. Regenerate with npm run default-credential:check.
Claim. A package default must not ship the same baked password to every user. This check renders each default base twice and fails if the password bytes are identical across installs. Fixed-password demo bases can exist only when they are explicit, non-default choices.
Helm generates a random password per install. cub renders deterministically and may ship an auth Secret in out/secrets/. If that value is identical for every install (same across namespaces, committed in the package), it is a shared default credential. Found by rendering each default base with two namespaces and comparing the Secret values.
Default bases shipping a FIXED credential: 0/12 (0%). Bases still named generated-passwords: 0. Overall: pass.
The fixed default credentials
| Chart | Default base | Fixed Secret(s) - placeholder shown where committed |
|---|---|---|
| - | - | none - no fixed default credentials |
This is a footgun, not a vulnerability per se: fixed values may be committed placeholders meant for render-parity demos. The safe default is an existing-Secret base that renders no credential and gives the user a command for generating fresh Secret material before apply.
Per chart
| Chart | Status |
|---|---|
| bitnami/nginx/24.0.2@http-clusterip | no-secret |
| bitnami/redis@reuse-existing-secret | no-secret |
| bitnami/mysql@existing-secret | no-secret |
| bitnami/mongodb@existing-secret-replicaset | no-secret |
| bitnami/rabbitmq@existing-secret | no-secret-data |
| bitnami/postgresql@existing-secret | no-secret |
| bitnami/apache@default | no-secret |
| bitnami/memcached@default | no-secret |
| bitnami/zookeeper@default | no-secret |
| bitnami/contour@default | no-secret |
| bitnami/opensearch@default | no-secret |
| bitnami/phpmyadmin@default | no-secret |
- Companion to the cub-installer fuzz's namespace findings - this is the secret rough edge. Receipt:
runs/default-credential-check/receipt.yaml.