GitHub Advisoryadvisory · Go

GHSA-prh4-vhfh-24mj Harbor: LDAP password and OIDC secret are not redacted in the audit log

MEDIUM Published 2026-03-26 Modified 2026-03-26 Official page ↗
Ecosystem
Go
Packages
github.com/goharbor/harbor
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-312, CWE-532
Reviewed
2026-03-26

Affected packages

• Go github.com/goharbor/harbor: >= 2.13.0, < 2.13.5 → fixed in 2.13.5 • Go github.com/goharbor/harbor: >= 2.14.0, < 2.14.3 → fixed in 2.14.3

Description

Impact Harbor write configuration payload to audit log when configuration change, the ldap_search_password and oidc_client_secret will be logged in the audit log without redacted Patches Harbor v2.15.0, v2.14.3, v2.13.5 Workarounds Disable audit log configure event in Harbor Web Console: Go to Administration -> Configuration -> Enable Audit Log Event Type -> Uncheck "Update Configuration" and click "Save" Button.

Related

Weakness · CWE (2)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References