Harbor vulnerabilities (CVE)

CVE records published for Harbor, newest first. Follow to get an email when a new one appears.

2 results

Unscored

CVE-2026-111590 14 days ago

SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

Harbor Harbor

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure…

9.4Critical

CVE-2026-4404 7 months ago

Use of hard coded credentials in GoHarbor Harbor

Harbor Harbor

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.