Harbor allows the use of the default password for web UI login

CRÍTICO 9.4CVE-2026-4404 · BIT-harbor-2026-4404 · GHSA-hj7x-hmf2-hc2p · Published 23/03/2026 · updated 10/08/2026

Em resumo

CVE-2026-4404 é uma vulnerabilidade CRÍTICO (CVSS 9.4) que afeta github.com/goharbor/harbor, harbor (linuxfoundation).
Chance de exploração nos próximos 30 dias (EPSS): 0.50%, maior que 42.8% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
github.com/goharbor/harbor Go	`≤ 2.15.0all versions`	No fix yet
harbor linuxfoundation	`≤ 2.15.0`	No fix yet

Description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

NVD description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

References

nvd.nist.gov/vuln/detail/CVE-2026-4404 · ADVISORY
goharbor/harbor · WEB
goharbor/harbor#22751 · WEB
goharbor/harbor · PACKAGE
goharbor.io/docs/1.10/install-config/run-installer-script · WEB
kb.cert.org/vuls/id/577436 · WEB
cwe.mitre.org/data/definitions/1393.html · Not Applicable
GitHub Advisory GHSA-hj7x-hmf2-hc2p · ADVISORY

Mais vulnerabilidades de github.com/goharbor/harbor

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/goharbor/harbor

≤ 2.15.0all versions

No fix yet

harbor

linuxfoundation

≤ 2.15.0

No fix yet

Description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

NVD description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

Mais vulnerabilidades de github.com/goharbor/harbor

Ver tudo →