EUVD-2026-14455Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Harbor instance on network
-
ExploitAttempt login with default credentials
-
ExecutionAuthenticate to web UI
-
ImpactAccess administrative functions and sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Default password prevention
|
| Exploitation Conditions | Remote unauthenticated attacker exploiting GoHarbor Harbor versions 2.15.0 and below with unchanged default credentials. No victim interaction required. Affects default installations where hardcoded credentials have not been modified. |
| Impact | This vulnerability presents critical real-world risk despite the absence of a CVSS score and EPSS data in the available intelligence. The attack vector is network-based and requires no special privileges or authentication prior to exploitation, making it trivially exploitable by any attacker with network access to the Harbor instance. The presence of hardcoded credentials represents a high-probability exploitation scenario, as attackers can methodically attempt known default credentials against publicly exposed Harbor instances. The lack of CVSS vector data does not diminish the severity—authentication bypass vulnerabilities affecting container registries are typically scored 9.0 or higher. Real-world risk is substantially elevated if Harbor instances are internet-facing or deployed in environments where credential rotation was not performed during initial setup, which is common in development and staging environments. |
| Exploit ScenarioDerived | An attacker discovers a Harbor instance exposed on the internet or accessible from a compromised internal network, then navigates to the Harbor web UI login page. Using the known default credentials (admin / Harbor12345), the attacker successfully authenticates as the administrator without requiring any additional exploits or techniques. Once authenticated, the attacker gains full control over the container registry, including the ability to push malicious container images, delete legitimate images, access pull secrets and registry tokens, and potentially compromise downstream systems that pull images from this registry. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
GoHarbor Harbor versions 2.15.0 and earlier contain hardcoded default credentials that allow unauthenticated attackers to gain administrative access to the web UI using the default username 'admin' and password 'Harbor12345'. This vulnerability enables complete compromise of the container registry, including image manipulation, deletion, and unauthorized access to stored artifacts. The issue has been documented in GitHub issues and pull requests within the Harbor project, indicating active awareness and remediation efforts by the development team.
RemediationAI
Upgrade GoHarbor Harbor to version 2.15.1 or later, which implements secure credential initialization. During initial deployment, immediately change the default administrator credentials from 'admin' / 'Harbor12345' to a strong, unique password via the Harbor web UI or API. For instances that cannot be immediately patched, implement network-level access controls by restricting access to the Harbor web UI to trusted IP ranges only, and place the Harbor instance behind a reverse proxy that enforces mutual TLS authentication. Audit all existing Harbor deployments to identify instances still using default credentials and prioritize their remediation. Review the GitHub pull request #22751 and associated security advisories from the Harbor project for deployment-specific guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Harbor is an open-source container image registry that provides secure image storage, vulnerability scanning, and access control. The vulnerability stems from CWE-1393 (use of hardcoded credentials), where default administrative credentials are embedded in the application configuration or deployment process rather than being securely generated during initial setup. The affected product is identified by CPE 2.3:a:harbor:harbor:*:*:*:*:*:*:*:*, indicating all versions up to 2.15.0 lack proper credential initialization mechanisms. The vulnerability allows attackers to bypass authentication controls entirely, treating the web UI as an unauthenticated administrative interface when default credentials remain unchanged.
Know when Harbor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
DescriptionCVE.org
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
Executive ViewAI
Organizations using GoHarbor Harbor face critical risk from CVE-2026-4404 rated CVSS 9.4. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/
Harbor through 2.15.2 can disclose scanner adapter AccessCredential secrets to an authenticated project administrator wh
A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and bel
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users A
Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor. Rated medium severity (
Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of
Harbor API has a Broken Access Control vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site. Rated medium severity
SQL-Injection in Harbor allows priviledge users to leak the task IDs. Rated medium severity (CVSS 5.5), this vulnerabili
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configur
A User Enumeration flaw exists in Harbor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable,
Same weakness CWE-1393 – Use of Default Password
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB