GitHub Advisoryadvisory · Go

GHSA-hj7x-hmf2-hc2p Harbor allows the use of the default password for web UI login

CRITICAL Published 2026-03-23 Modified 2026-03-25 Official page ↗
Aliases
CVE-2026-4404
Ecosystem
Go
Packages
github.com/goharbor/harbor
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-1393, CWE-798
Reviewed
2026-03-25

Affected packages

• Go github.com/goharbor/harbor: <= 2.15.0 (no fix yet)

Description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

Related

Alias · CVE (1)

  • CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to… vulnerability

Weakness · CWE (2)

  • CWE-1393 Use of Default Password weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References