Harbor allows the use of the default password for web UI login

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-4404 · ADVISORY
• goharbor/harbor · WEB
• goharbor/harbor#22751 · WEB
• goharbor/harbor · PACKAGE
• goharbor.io/docs/1.10/install-config/run-installer-script · WEB
• kb.cert.org/vuls/id/577436 · WEB
• cwe.mitre.org/data/definitions/1393.html · Not Applicable
• GitHub Advisory GHSA-hj7x-hmf2-hc2p · ADVISORY

Altre vulnerabilità di github.com/goharbor/harbor

• GO-2026-4876Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor
• GHSA-prh4-vhfh-24mjMEDIOHarbor: LDAP password and OIDC secret are not redacted in the audit log
• CVE-2025-30086MEDIO 4.9CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak presen…
• CVE-2025-32019MEDIO 4.1Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as …
• CVE-2022-31671ALTO 7.4Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a …