by Kastro
Paper/Archive/CVE-2026-4404

CVE-2026-4404

Harbor Harbor — Use of hard coded credentials in GoHarbor Harbor

EPSS 0.5%CVSS 9.4
critical.is priorityof 100
37
CVSS 9.4 (ADP)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 42.8.428 × 208.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

Affected

ProductAffectedFixed inSource
Harbor0.1.0 – 2.15.0–CNA

Scores by source

CISA ADP9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgoharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345refgithub.com/goharbor/harbor/issues/1937refcwe.mitre.org/data/definitions/1393.htmlrefgithub.com/goharbor/harbor/pull/22751refkb.cert.org/vuls/id/577436