CVE-2026-4404: GoHarbor Harbor Default Password Vulnerability
Summary
CVE-2026-4404: Harbor allows the use of the default password for web UI login. Affects github.com/goharbor/harbor versions < 2.15.0. No fix is published. How to fix ↓
Also tracked for
- harbor · Bitnami
The same CVE-2026-4404 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GoHarbor Harbor is an open-source container registry that facilitates the management of container images and artifacts. It provides a web-based user interface for users to manage their images, repositories, and access controls. However, versions 2.15.0 and below have a critical security flaw that allows unauthorized access through the use of hard-coded default credentials.
Vulnerability Detail
The vulnerability arises from the use of hard-coded credentials in GoHarbor Harbor versions 2.15.0 and below. Attackers can exploit this flaw by using the default password to gain unauthorized access to the web UI. This can lead to severe consequences, including data breaches, unauthorized modifications, and potential control over the container registry. The vulnerability is classified under CWE-1393 and CWE-798, indicating issues related to hard-coded credentials and insecure use of credentials.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can change the default password immediately after installation to prevent unauthorized access. This can be done through the web UI or by modifying the configuration files directly to set a new password.
Conclusion
The GoHarbor Harbor default password vulnerability (CVE-2026-4404) poses a critical risk to users of versions 2.15.0 and below. It is essential to update to the patched version to mitigate the risk of unauthorized access. Users should also consider changing default credentials as a temporary measure until they can apply the update.
See every vulnerability recorded for github.com/goharbor/harbor →
FAQ
The vulnerability has a CVSS score of 9.4, indicating it is critical and poses a significant risk to users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and control over the container registry, which can severely impact your operations.
Yes, a patch is available in version 2.15.1 and later of GoHarbor Harbor. It is recommended to update to this version.
If immediate updating is not possible, ensure to change the default password and monitor access logs for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/goharbor/harbor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
