CVE-2019-19023: Privilege Escalation in Cloud Native Computing Foundation Harbor
Summary
CVE-2019-19023: Privilege Escalation in Cloud Native Computing Foundation Harbor. Affects github.com/goharbor/harbor across 2 version ranges.
>= 1.7.0, < 1.8.6
>= 1.9.0, < 1.9.3
Fixed in 1.8.6 or 1.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cloud Native Computing Foundation Harbor is a container registry for the Pivotal Platform. It allows users to store, sign, and scan container images for vulnerabilities. The Harbor registry is written in Go and is widely used in cloud-native environments. However, versions prior to 1.8.6 and 1.9.3 are vulnerable to privilege escalation.
Vulnerability Detail
The Privilege Escalation vulnerability in Cloud Native Computing Foundation Harbor allows an attacker to gain elevated privileges in the VMware Harbor Container Registry for the Pivotal Platform. This can lead to unauthorized access, data manipulation, or even a complete compromise of the container registry. The vulnerability has a CVSS score of 9.3, indicating a high severity level.
How To Fix
Latest published version: v2.15.4+incompatible as of 23 Oct 2026
go get github.com/goharbor/harbor@v2.15.4+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.7.0, < 1.8.61.8.6go get github.com/goharbor/harbor@v1.8.6 -
>= 1.9.0, < 1.9.31.9.3go get github.com/goharbor/harbor@v1.9.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Cloud Native Computing Foundation Harbor.
Conclusion
The Privilege Escalation vulnerability in Cloud Native Computing Foundation Harbor can have severe consequences, including unauthorized access and data manipulation. It is crucial to upgrade to the patched versions (1.8.6 or 1.9.3) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/goharbor/harbor →
FAQ
Cloud Native Computing Foundation Harbor is a container registry for the Pivotal Platform. It allows users to store, sign, and scan container images for vulnerabilities.
The vulnerability allows an attacker to gain elevated privileges in the VMware Harbor Container Registry for the Pivotal Platform, potentially leading to unauthorized access, data manipulation, or a complete compromise of the container registry.
The CVSS score of this vulnerability is 9.3, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to version 1.8.6 if using a version between 1.7.0 and 1.8.5, or upgrade to version 1.9.3 if using a version between 1.9.0 and 1.9.2.
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Cloud Native Computing Foundation Harbor.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/goharbor/harbor.
