Harbor vulnerabilities
We track 5 vulnerabilities in Harbor products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on March 23, 2026.
Latest Harbor vulnerabilities
- 9.4 Critical severity
Harbor: Use of Hard-coded Credentials
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
- 7.4 High severity
Harbor: Incorrect Authorization
Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticate
- 7.7 High severity
Harbor: Incorrect Authorization
Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modi
- 7.7 High severity
Harbor: Incorrect Authorization
Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker coul
- 7.7 High severity
Harbor: Incorrect Authorization
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p