EUVD-2026-14455Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
AnalysisAI
GoHarbor Harbor versions 2.15.0 and earlier contain hardcoded default credentials that allow unauthenticated attackers to gain administrative access to the web UI using the default username 'admin' and password 'Harbor12345'. This vulnerability enables complete compromise of the container registry, including image manipulation, deletion, and unauthorized access to stored artifacts. The issue has been documented in GitHub issues and pull requests within the Harbor project, indicating active awareness and remediation efforts by the development team.
Technical ContextAI
Harbor is an open-source container image registry that provides secure image storage, vulnerability scanning, and access control. The vulnerability stems from CWE-1393 (use of hardcoded credentials), where default administrative credentials are embedded in the application configuration or deployment process rather than being securely generated during initial setup. The affected product is identified by CPE 2.3:a:harbor:harbor:*:*:*:*:*:*:*:*, indicating all versions up to 2.15.0 lack proper credential initialization mechanisms. The vulnerability allows attackers to bypass authentication controls entirely, treating the web UI as an unauthenticated administrative interface when default credentials remain unchanged.
RemediationAI
Upgrade GoHarbor Harbor to version 2.15.1 or later, which implements secure credential initialization. During initial deployment, immediately change the default administrator credentials from 'admin' / 'Harbor12345' to a strong, unique password via the Harbor web UI or API. For instances that cannot be immediately patched, implement network-level access controls by restricting access to the Harbor web UI to trusted IP ranges only, and place the Harbor instance behind a reverse proxy that enforces mutual TLS authentication. Audit all existing Harbor deployments to identify instances still using default credentials and prioritize their remediation. Review the GitHub pull request #22751 and associated security advisories from the Harbor project for deployment-specific guidance.
The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/
A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and bel
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users A
Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor. Rated medium severity (
Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of
Harbor API has a Broken Access Control vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site. Rated medium severity
SQL-Injection in Harbor allows priviledge users to leak the task IDs. Rated medium severity (CVSS 5.5), this vulnerabili
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configur
A User Enumeration flaw exists in Harbor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable,
Same weakness CWE-1393 – Use of Default Password
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today