Harbor allows the use of the default password for web UI login

CRITICAL 9.4CVE-2026-4404 · BIT-harbor-2026-4404 · GHSA-hj7x-hmf2-hc2p · Published 23/03/2026 · updated 10/08/2026

Package	Affected versions	Patched versions
github.com/goharbor/harbor Go	`≤ 2.15.0all versions`	No fix yet
harbor linuxfoundation	`≤ 2.15.0`	No fix yet

Description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

NVD description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

References

nvd.nist.gov/vuln/detail/CVE-2026-4404 · ADVISORY
goharbor/harbor · WEB
goharbor/harbor#22751 · WEB
goharbor/harbor · PACKAGE
goharbor.io/docs/1.10/install-config/run-installer-script · WEB
kb.cert.org/vuls/id/577436 · WEB
cwe.mitre.org/data/definitions/1393.html · Not Applicable
GitHub Advisory GHSA-hj7x-hmf2-hc2p · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free