CVE-2019-19025: Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor
Summary
CVE-2019-19025: Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor. Affects github.com/goharbor/harbor across 2 version ranges.
>= 1.7.0, < 1.8.6
>= 1.9.0, < 1.9.3
Fixed in 1.8.6 or 1.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cloud Native Computing Foundation Harbor is a container registry that provides a secure and scalable platform for managing container images. It is written in Go and is widely used in the industry. However, versions prior to 1.8.6 and 1.9.3 are vulnerable to Cross-site Request Forgery (CSRF) attacks in the VMware Harbor Container Registry for the Pivotal Platform.
Vulnerability Detail
The vulnerability allows an attacker to perform CSRF attacks on the Harbor Container Registry. This means that an attacker can trick a user into performing unintended actions on the registry, such as uploading or deleting images. This can lead to unauthorized access, data leakage, or disruption of the container registry. The vulnerability has a CVSS score of 7.6, indicating a moderate severity level.
How To Fix
Latest published version: v2.15.4+incompatible as of 23 Oct 2026
go get github.com/goharbor/harbor@v2.15.4+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.7.0, < 1.8.61.8.6go get github.com/goharbor/harbor@v1.8.6 -
>= 1.9.0, < 1.9.31.9.3go get github.com/goharbor/harbor@v1.9.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided fix by upgrading to the fixed versions of Harbor.
Conclusion
In conclusion, Cloud Native Computing Foundation Harbor versions prior to 1.8.6 and 1.9.3 are vulnerable to Cross-site Request Forgery (CSRF) attacks. It is important to upgrade to the fixed versions of Harbor to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/goharbor/harbor →
FAQ
Cloud Native Computing Foundation Harbor is a container registry that provides a secure and scalable platform for managing container images.
Cross-site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the context of Harbor, it means that an attacker can trick a user into performing unintended actions on the container registry.
The vulnerability can lead to unauthorized access, data leakage, or disruption of the container registry.
The CVSS score of this vulnerability is 7.6, indicating a moderate severity level.
To fix the vulnerability, it is recommended to upgrade to the fixed versions of Harbor: 1.8.6 or 1.9.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/goharbor/harbor.
