CVE-2026-4404

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI...

EUVD-2026-14455

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI...

CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI...

CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI...

Bringing Continuous Assessment to Harbor: Scan on Push, Stay Secure Over Time

Key Takeaways Harbor environments often run separate scanners, such as Trivy at build time and Qualys at runtime, leading to repeated full-image rescans across hundreds of thousands of images and increasing compute usage, scan time, and operational costs. Integrating QScanner with Harbor eliminat...

Harbor 安全漏洞

Harbor is an open-source registry developed by Harbor Open Source. It protects artifacts through policy-based and role-based access control, ensures that images are scanned for vulnerabilities, and signs images as trustworthy. Versions of Harbor prior to 2.15.0 have security vulnerabilities; thes...

PT-2026-27137

Name of the Vulnerable Software and Affected Versions GoHarbor versions prior to 2.15.0 Description The use of hard-coded credentials in GoHarbor allows attackers to use the default password and gain access to the web user interface. Recommendations Update GoHarbor to version 2.15.0 or later...

GHSA-P77J-4MVH-X3M3 vulnerabilities

Vulnerabilities for packages: gatekeeper, telegraf, grafana-agent-operator, scorecard, harbor-registry, cert-manager-csi-driver, seaweedfs, crossplane-provider-aws-cloudwatchlogs, multus-cni, kube-rbac-proxy, crossplane-provider-aws-kinesis, terraform, bank-vaults, rancher-webhook, yunikorn-k8shi...

CVE-2026-33186 vulnerabilities

Vulnerabilities for packages: gatekeeper, telegraf, grafana-agent-operator, scorecard, harbor-registry, cert-manager-csi-driver, seaweedfs, crossplane-provider-aws-cloudwatchlogs, multus-cni, kube-rbac-proxy, crossplane-provider-aws-kinesis, terraform, bank-vaults, rancher-webhook, yunikorn-k8shi...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: eks-distro-fips, beats-fips, tekton-chains, trivy, livekit-cli, prometheus-adapter-fips, spire-server, percona-server-mongodb-operator-fips, flux-kustomize-controller-fips, rke2-runtime, harbor-fips, gatekeeper-fips, tflint-fips, cass-operator, gcsfuse, kyverno,...

CLEANSTART-2026-PC16040 Within HostnameError

Multiple security vulnerabilities affect the harbor-registry-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-BZ92766 beego is an open-source web framework for the Go programming language

Multiple security vulnerabilities affect the harbor-fips package. beego is an open-source web framework for the Go programming language. See references for individual vulnerability details...

CLEANSTART-2026-QK01721 go-redis is the official Redis client library for the Go programming language

Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...

CLEANSTART-2026-OI08379 Cancelling a query (e

Multiple security vulnerabilities affect the harbor-fips package. Cancelling a query e. See references for individual vulnerability details...

CLEANSTART-2026-XX70537 Cancelling a query (e

Multiple security vulnerabilities affect the harbor-fips package. Cancelling a query e. See references for individual vulnerability details...

CLEANSTART-2026-PO40318 go-redis is the official Redis client library for the Go programming language

Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...

CLEANSTART-2026-RY09679 go-redis is the official Redis client library for the Go programming language

Security vulnerability affects the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language...

CLEANSTART-2026-PG91940 net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines

Multiple security vulnerabilities affect the harbor-registry package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. See references for individual vulnerability details...

CLEANSTART-2026-ZO91195 go-redis is the official Redis client library for the Go programming language

Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...

BIT-HARBOR-2024-22261 SQL Injection in Harbor scan log API

SQL-Injection in Harbor allows priviledge users to leak the task IDs...