CVSS 3.1
9.4 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LCVE-2026-4404
Critical (9.4) in linuxfoundation harbor. EPSS 0.5% chance of exploitation in the next 30 days.
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-798, CWE-1393
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linuxfoundation:harbor
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hj7x-hmf2-hc2p | Go | github.com/goharbor/harbor | <=2.15.0 | no fix published |
| GO-2026-4845 | Go | github.com/goharbor/harbor | all versions | no fix published |
References
- https://cwe.mitre.org/data/definitions/1393.html
- https://github.com/goharbor/harbor/issues/1937
- https://github.com/goharbor/harbor/pull/22751
- https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345
- https://www.kb.cert.org/vuls/id/577436