CVE-2026-4404

Published: Mar 23, 2026Modified: Aug 10, 2026

9.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Exploitability: 3.9 / Impact: 5.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

Affected (1)

Products: Linuxfoundation: Harbor

Linuxfoundation

1 product

Harbor

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Harbor	Up to 2.15.0

Related CWEs

CWE-1393

Use of Default Password

The product uses default passwords for potentially critical functionality.

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (5)

https://cwe.mitre.org/data/definitions/1393.html

Source: cret@cert.org

Not Applicable

https://github.com/goharbor/harbor/issues/1937

Source: cret@cert.org

Issue Tracking

https://github.com/goharbor/harbor/pull/22751

Source: cret@cert.org

Issue Tracking

https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345

Source: cret@cert.org

Product

https://www.kb.cert.org/vuls/id/577436

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.