CVE-2019-19026: SQL Injection in Cloud Native Computing Foundation Harbor
Summary
CVE-2019-19026: SQL Injection in Cloud Native Computing Foundation Harbor. Affects github.com/goharbor/harbor across 2 version ranges.
>= 1.7.0, < 1.8.6
>= 1.9.0, < 1.9.3
Fixed in 1.8.6 or 1.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cloud Native Computing Foundation Harbor is a container registry that provides storage and distribution services for container images. It is designed to be a secure and scalable solution for managing container images in a cloud-native environment. The vulnerability identified as CVE-2019-19026 affects versions prior to 1.8.6 and 1.9.3 of Harbor. This vulnerability allows for SQL Injection through project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
Vulnerability Detail
The SQL Injection vulnerability in Harbor allows an attacker to manipulate SQL queries by injecting malicious input into project quotas. This can lead to unauthorized access, data leakage, or even complete compromise of the Harbor system. The vulnerability is rated as moderate severity with a CVSS score of 4.9. It falls under CWE-89, which is the category for SQL Injection vulnerabilities.
How To Fix
Latest published version: v2.15.4+incompatible as of 23 Oct 2026
go get github.com/goharbor/harbor@v2.15.4+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.7.0, < 1.8.61.8.6go get github.com/goharbor/harbor@v1.8.6 -
>= 1.9.0, < 1.9.31.9.3go get github.com/goharbor/harbor@v1.9.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed versions of Harbor.
Conclusion
The SQL Injection vulnerability in Cloud Native Computing Foundation Harbor can have serious consequences, including unauthorized access, data leakage, and compromise of the entire system. It is crucial to upgrade to the fixed versions of Harbor (1.8.6 or 1.9.3) to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/goharbor/harbor →
FAQ
Harbor is a container registry that provides storage and distribution services for container images in a cloud-native environment.
SQL Injection is a type of vulnerability that allows an attacker to manipulate SQL queries by injecting malicious input. This can lead to unauthorized access, data leakage, or compromise of the affected system.
The SQL Injection vulnerability in Harbor can allow an attacker to manipulate SQL queries and potentially gain unauthorized access, leak sensitive data, or compromise the entire Harbor system.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Harbor (1.8.6 or 1.9.3) that include patches to prevent SQL Injection attacks.
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed versions of Harbor is the recommended approach.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/goharbor/harbor.
