CVE-2025-30086: ORM Leak Vulnerability in github.com/goharbor/harbor
Summary
CVE-2025-30086: Possible ORM Leak Vulnerability in the Harbor. Affects github.com/goharbor/harbor across 3 version ranges.
< 2.4.0-rc1.0.20250331071157-dce7d9f5cffb
>= 2.4.0-rc1.1, < 2.12.4
>= 2.13.0, < 2.13.1
Fixed in 2.4.0-rc1.0.20250331071157-dce7d9f5cffb, 2.12.4 or 2.13.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Harbor is an open-source cloud-native registry that stores, signs, and scans content. It provides a robust solution for managing container images and Helm charts, enabling users to maintain control over their artifacts. The package is widely used in DevOps environments to enhance security and compliance. However, it is vulnerable to an ORM leak that could expose sensitive user information.
Vulnerability Detail
The vulnerability arises from an ORM Leak present in the '/api/v2.0/users' endpoint of Harbor. It allows administrator users to exploit the 'q' URL parameter to filter users by any column, including passwords. By using a filter like 'password=~', an attacker can leak a user's password hash character by character. This could lead to unauthorized access to sensitive information stored in the Harbor database, compromising user security.
How To Fix
Latest published version: v2.15.4+incompatible as of 23 Oct 2026
go get github.com/goharbor/harbor@v2.15.4+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.0-rc1.0.20250331071157-dce7d9f5cffb2.4.0-rc1.0.20250331071157-dce7d9f5cffbgo get github.com/goharbor/harbor@v2.4.0-rc1.0.20250331071157-dce7d9f5cffb -
>= 2.4.0-rc1.1, < 2.12.42.12.4go get github.com/goharbor/harbor@v2.12.4 -
>= 2.13.0, < 2.13.12.13.1go get github.com/goharbor/harbor@v2.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
The ORM leak vulnerability in Harbor poses a significant risk to user data security. It is crucial for users to update to the patched versions to safeguard against potential exploits. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for github.com/goharbor/harbor →
FAQ
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
Administrator users on Harbor can exploit this vulnerability due to their access level.
The vulnerability allows leaking of users' password hashes and salt values, which are sensitive pieces of information.
Yes, patches are available for versions 2.13.1 and 2.12.4. Users should upgrade to these versions to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/goharbor/harbor.
