CVE-2026-4404

Published: Mar 23, 2026Modified: Jun 17, 2026

9.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Exploitability: 3.9 / Impact: 5.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

Related CWEs

CWE-1393

Use of Default Password

The product uses default passwords for potentially critical functionality.

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (5)

https://cwe.mitre.org/data/definitions/1393.html

Source: cret@cert.org

https://github.com/goharbor/harbor/issues/1937

Source: cret@cert.org

https://github.com/goharbor/harbor/pull/22751

Source: cret@cert.org

https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345

Source: cret@cert.org

https://www.kb.cert.org/vuls/id/577436

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.