9.4Critical
CVE-2026-4404Use of hard coded credentials in GoHarbor Harbor
Description
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Harbor | Harbor | 0.1.0 – ≤ 2.15.0 | |
| linuxfoundation | harbor | ≤ 2.15.0 |
References and patches
- https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20th… Product
- https://github.com/goharbor/harbor/issues/1937 Issue Tracking
- https://cwe.mitre.org/data/definitions/1393.html Not Applicable
- https://github.com/goharbor/harbor/pull/22751 Issue Tracking
- https://www.kb.cert.org/vuls/id/577436 Third Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*≤ 2.15.0