CVE-2026-4404

CRITICAL

Use of hard coded credentials in GoHarbor Harbor

Title source: cna
STIX 2.1

Description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

References (5)

Core 5

Scores

CVSS v3 9.4
EPSS 0.0050
EPSS Percentile 38.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-1393 CWE-798
Status published
Products (2)
goharbor/harbor 0Go
Harbor/Harbor 0.1.0 - 2.15.0
Published Mar 23, 2026
Tracked Since Mar 23, 2026