CVE-2025-30086: ORM Leak Vulnerability in github.com/goharbor/harbor
Summary
CVE-2025-30086: Possible ORM Leak Vulnerability in the Harbor in github.com/goharbor/harbor. Affects github.com/goharbor/harbor across 2 version ranges.
< 2.12.4+incompatible
>= 2.13.0+incompatible, < 2.13.1+incompatible
Fixed in 2.12.4+incompatible or 2.13.1+incompatible, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Harbor is an open-source cloud-native registry that stores, signs, and scans content. It provides a centralized location for managing container images and Helm charts, enhancing security and compliance in containerized environments. However, it has been identified to have a potential ORM leak vulnerability that could expose sensitive data.
Vulnerability Detail
The vulnerability, identified as CVE-2025-30086, arises from a possible ORM leak in the Harbor package. This issue can lead to unintended data exposure, where sensitive information may be accessible to unauthorized users. The vulnerability affects versions of Harbor prior to v2.4.0-rc1.0.20250331071157-dce7d9f5cffb, and it is crucial for users to be aware of the implications of this flaw, as it could compromise the integrity and confidentiality of stored data.
How To Fix
Latest published version: v2.15.4+incompatible as of 23 Oct 2026
go get github.com/goharbor/harbor@v2.15.4+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.12.4+incompatible2.12.4+incompatiblego get github.com/goharbor/harbor@v2.12.4+incompatible -
>= 2.13.0+incompatible, < 2.13.1+incompatible2.13.1+incompatiblego get github.com/goharbor/harbor@v2.13.1+incompatible
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing access controls to limit exposure to sensitive data until the package can be updated. Regularly review and audit your access logs to identify any unauthorized access attempts.
Conclusion
The ORM leak vulnerability in Harbor poses a significant risk to users by potentially exposing sensitive data. It is essential to update to the latest versions to ensure the security of your applications. Regular monitoring and auditing of your systems can help mitigate risks associated with this vulnerability.
See every vulnerability recorded for github.com/goharbor/harbor →
FAQ
CVE-2025-30086 is a vulnerability in the Harbor package that may lead to ORM leaks, potentially exposing sensitive data.
Versions of Harbor prior to v2.4.0-rc1.0.20250331071157-dce7d9f5cffb are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update your Harbor package to the latest patched version, either v2.12.4+incompatible or v2.13.1+incompatible, to mitigate this vulnerability.
Failing to address this vulnerability could lead to unauthorized access to sensitive data, compromising the security and integrity of your container images and Helm charts.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/goharbor/harbor.
