GHSA-hj7x-hmf2-hc2p

Harbor allows the use of the default password for web UI login

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-4404

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/goharbor/harbor	<= 2.15.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-4404 advisory
https://github.com/goharbor/harbor/issues/1937 web
https://github.com/goharbor/harbor/pull/22751 web
https://github.com/goharbor/harbor package
https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20d… web
https://www.kb.cert.org/vuls/id/577436 web