Harbor vulnerabilities

Products

• Harbor 5
• Project 1

Latest Harbor CVEs

Newest publication first

1. CVE-2026-111590 SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

   Published 2026-10-26

   Unknown EPSS 0.21%

   A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy poi...

2. CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor

   Published 2026-03-23

   Critical·CVSS 9.4 EPSS 0.51%

   Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

3. CVE-2024-22278 Harbor fails to validate the user permissions when updating project configurations

   Published 2024-08-02

   Medium·CVSS 4.3 EPSS 0.37%

   Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.

4. CVE-2024-22261 SQL Injection in Harbor scan log API

   Published 2024-06-10

   Medium·CVSS 5.5 EPSS 0.42%

   SQL-Injection in Harbor allows priviledge users to leak the task IDs

5. CVE-2024-22244 Harbor Open Redirect URL

   Published 2024-06-10

   Medium·CVSS 6.1 EPSS 0.36%

   Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site.

6. CVE-2023-20902 Timing attack risk in Harbor

   Published 2023-11-09

   Medium·CVSS 6.5 EPSS 0.46%

   A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.