CVE-2026-4404

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

CVSS v3 9.4 CRITICAL

9.4^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://cwe.mitre.org/data/definitions/1393.html	Not Applicable
https://github.com/goharbor/harbor/issues/1937	Issue Tracking
https://github.com/goharbor/harbor/pull/22751	Issue Tracking
https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345	Product
https://www.kb.cert.org/vuls/id/577436	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-23 15:16

Updated : 2026-08-10 14:36

NVD link : CVE-2026-4404

Mitre link : CVE-2026-4404

CVE.ORG link : CVE-2026-4404

JSON object : View

Products Affected

linuxfoundation

harbor

CWE

CWE-798

Use of Hard-coded Credentials

CWE-1393

Use of Default Password

{"id": "CVE-2026-4404", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4404", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:24:29.261835Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Harbor", "product": "Harbor", "versions": [{"status": "affected", "version": "0.1.0", "versionType": "custom", "lessThanOrEqual": "2.15.0"}]}]}], "published": "2026-03-23T15:16:35.403", "references": [{"url": "https://cwe.mitre.org/data/definitions/1393.html", "tags": ["Not Applicable"], "source": "cret@cert.org"}, {"url": "https://github.com/goharbor/harbor/issues/1937", "tags": ["Issue Tracking"], "source": "cret@cert.org"}, {"url": "https://github.com/goharbor/harbor/pull/22751", "tags": ["Issue Tracking"], "source": "cret@cert.org"}, {"url": "https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345", "tags": ["Product"], "source": "cret@cert.org"}, {"url": "https://www.kb.cert.org/vuls/id/577436", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-798"}, {"lang": "en", "value": "CWE-1393"}]}], "descriptions": [{"lang": "en", "value": "Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI."}, {"lang": "es", "value": "Uso de credenciales codificadas de forma r\u00edgida en GoHarbor Harbor versi\u00f3n 2.15.0 y anteriores, permite a los atacantes usar la contrase\u00f1a predeterminada y obtener acceso a la interfaz de usuario web."}], "lastModified": "2026-08-10T14:36:20.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CF7C162-60E3-4571-AC1F-17F7F9074D7C", "versionEndIncluding": "2.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}