Harbor <=1.82.0 - Privilege Escalation

Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration. id: CVE-2019-16097...

GHSA-5CGQ-3RG8-M6CV vulnerabilities

Vulnerabilities for packages: omnictl-multiarch, knative-kafka-broker, apply-cve-bump, traefik, harbor-fips, telegraf, containerd, keda-fips, gitlab-rails-ce, kyverno-fips, prometheus-mongodb-exporter, argo-cd, commercial-grafana, argo-events, argo-events-fips, backup-restore-operator,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, telegraf, containerd, external-dns, keda-fips, kyverno-fips, argocd-image-updater-fips, spire-server, commercial-grafana, osv-scanner, external-secrets-operator-fips, cert-manager, backup-restore-operator, zarf, gitlab-rails-ce-fips, gitea-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, tflint-fips, rancher-machine, cg, nfpm, telegraf, flux-operator-fips, docker-fips, containerd, external-dns, crossplane-provider-azure-spring, keda-fips, consul-fips, kyverno-fips, argocd-image-updater-fips, ko-fips, spire-server, apko,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, rancher-machine, cg, nfpm, telegraf, docker-fips, containerd, external-dns, keda-fips, kyverno-fips, argocd-image-updater-fips, longhorn-manager-fips, spire-server, apko, act, commercial-grafana, mapotf, osv-scanner, argo-events-fips,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, telegraf, containerd, external-dns, keda-fips, kyverno-fips, spire-server, commercial-grafana, external-secrets-operator-fips, cert-manager, backup-restore-operator, gitlab-rails-ce-fips, kube-arangodb-fips, kyverno, argo-workflows, harbor,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, cg, nfpm, telegraf, containerd, external-dns, keda-fips, consul-fips, kyverno-fips, argocd-image-updater-fips, spire-server, apko, act, commercial-grafana, mapotf, osv-scanner, argo-events-fips, external-secrets-operator-fips, cert-manager,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, tflint-fips, rancher-machine, cg, nfpm, telegraf, flux-operator-fips, docker-fips, containerd, external-dns, crossplane-provider-azure-spring, keda-fips, consul-fips, kyverno-fips, argocd-image-updater-fips, ko-fips, spire-server, apko,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, telegraf, containerd, external-dns, keda-fips, kyverno-fips, spire-server, commercial-grafana, external-secrets-operator-fips, cert-manager, backup-restore-operator, terraform-fips, gitlab-rails-ce-fips, kube-arangodb-fips, kyverno,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, telegraf, containerd, external-dns, keda-fips, kyverno-fips, argocd-image-updater-fips, spire-server, commercial-grafana, osv-scanner, external-secrets-operator-fips, cert-manager, backup-restore-operator, zarf, gitlab-rails-ce-fips, gitea-fips,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: k6, terraform, opentofu, flux, frp, juicefs, bento, rancher, trufflehog, flux-source-controller, openbao, xeol, yunikorn-k8shim, gitlab-runner, kyverno-notation-aws, ratify, nuclei, cert-manager-cmctl, rancher-webhook, spqr, gitea, teleport, harbor, rancher-agent,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: k6, terraform, opentofu, flux, frp, juicefs, bento, rancher, trufflehog, flux-source-controller, openbao, xeol, yunikorn-k8shim, gitlab-runner, kyverno-notation-aws, ratify, nuclei, cert-manager-cmctl, rancher-webhook, spqr, gitea, teleport, harbor, rancher-agent,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: telegraf, rancher-webhook, versitygw, kyverno-fips, commercial-grafana, agentbeat-fips, cert-manager-csi-driver, external-secrets-operator-fips, cert-manager, terraform-fips, xeol-fips, bento-fips, external-secrets-fips, grafana-fips, gitea-fips,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: telegraf, rancher-webhook, versitygw, kyverno-fips, commercial-grafana, agentbeat-fips, cert-manager-csi-driver, external-secrets-operator-fips, cert-manager, terraform-fips, xeol-fips, bento-fips, external-secrets-fips, grafana-fips, gitea-fips,...

CLEANSTART-2026-DR81473 HashiCorp’s go-getter library up to v1

Multiple security vulnerabilities affect the harbor-scanner-trivy-fips package. HashiCorp’s go-getter library up to v1. See references for individual vulnerability details...

GO-2026-4876 Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor

Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor...

PT-2026-29931

Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor...

CLEANSTART-2026-FB05615 Security fixes for CVE-2025-15558, CVE-2025-53547, CVE-2025-55198, CVE-2025-55199, CVE-2026-27141, ghsa-557j-xg8c-q2mm, ghsa-9h84-qmv7-982p, ghsa-f6x5-jh6r-wrfv, ghsa-f9f8-9pmf-xv68, ghsa-j5w8-q4qc-rx2x, ghsa-p436-gjf2-799p applied in versions: 2.13.4-r0, 2.13.4-r1, 2.13.4-r2

Multiple security vulnerabilities affect the harbor package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LB23787 Security fixes for CVE-2021-3538, CVE-2025-15558, CVE-2025-29923, CVE-2025-53547, CVE-2025-55198, CVE-2025-55199, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-27139, CVE-2026-27141, CVE-2026-27142, CVE-2026-33186, ghsa-557j-xg8c-q2mm, ghsa-9h84-qmv7-982p, ghsa-f6x5-jh6r-wrfv, ghsa-f9f8-9pmf-xv68, ghsa-j5w8-q4qc-rx2x, ghsa-p436-gjf2-799p applied in versions: 2.13.4-r0, 2.13.4-r1, 2.13.4-r2, 2.13.5-r0, 2.13.5-r1

Multiple security vulnerabilities affect the harbor package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PE63912 Security fixes for CVE-2021-3538, CVE-2025-29923, CVE-2025-53547, CVE-2025-55198, CVE-2025-55199, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-27139, CVE-2026-27141, CVE-2026-27142, CVE-2026-33186, ghsa-557j-xg8c-q2mm, ghsa-9h84-qmv7-982p, ghsa-f6x5-jh6r-wrfv, ghsa-f9f8-9pmf-xv68, ghsa-j5w8-q4qc-rx2x applied in versions: 2.14.2-r0, 2.14.2-r1, 2.15.0-r0, 2.15.0-r1

Multiple security vulnerabilities affect the harbor package. These issues are resolved in later releases. See references for individual vulnerability details...