CVE-2022-31670: Harbor Fails to Validate User Permissions When Updating Tag Retention Policies
Summary
CVE-2022-31670: Harbor fails to validate the user permissions when updating tag retention policies. Affects github.com/goharbor/harbor across 3 version ranges.
>= 1.0.0, < 1.10.13
>= 2.0.0, < 2.4.3
>= 2.5.0, < 2.5.2
Fixed in 1.10.13, 2.4.3 or 2.5.2, depending on the release line you run. How to fix ↓
Also tracked for
- harbor · Bitnami
The same CVE-2022-31670 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Harbor is an open-source container registry that allows users to store, sign, and scan container images for vulnerabilities. It is written in Go and is widely used in containerized environments. The vulnerability identified as CVE-2022-31670 affects versions of Harbor prior to 2.5.2 and allows attackers to modify tag retention policies in projects they do not have access to.
Vulnerability Detail
The vulnerability arises from a lack of validation of user permissions when updating tag retention policies in Harbor. By sending a request to update a tag retention policy with an ID belonging to a project that the authenticated user does not have access to, an attacker can modify tag retention policies configured in other projects. This can lead to unauthorized access and potential data manipulation or destruction.
How To Fix
Latest published version: v2.15.4+incompatible as of 23 Oct 2026
go get github.com/goharbor/harbor@v2.15.4+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.10.131.10.13go get github.com/goharbor/harbor@v1.10.13 -
>= 2.0.0, < 2.4.32.4.3go get github.com/goharbor/harbor@v2.4.3 -
>= 2.5.0, < 2.5.22.5.2go get github.com/goharbor/harbor@v2.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds available for this vulnerability. It is essential to upgrade to the fixed version of Harbor to mitigate the risk of unauthorized access and data manipulation.
Conclusion
The vulnerability in Harbor that fails to validate user permissions when updating tag retention policies can lead to unauthorized access and data manipulation. It is crucial to upgrade to Harbor version 2.5.2 or later to mitigate this risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/goharbor/harbor →
FAQ
Harbor is an open-source container registry used for storing, signing, and scanning container images.
The vulnerability allows attackers to modify tag retention policies in projects they do not have access to, potentially leading to unauthorized access and data manipulation.
To fix this vulnerability, upgrade to Harbor version 2.5.2 or later.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
This vulnerability was reported by Gal Goldstein and Daniel Abeles from Oxeye Security.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/goharbor/harbor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
