Vulnerability Database · Go · Package report
github.com/goharbor/harbor: vulnerability history, versions and safety
github.com/goharbor/harbor is a package in the Go ecosystem. Vulert records 41 vulnerabilities for it across 120 releases, from May 2021 to Apr 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.
No patched version yet — these are the ones to plan around.
See the unfixed vulnerabilities →No published version shipped hostile code.
Vulert verdict on github.com/goharbor/harbor v2.15.4+incompatible i
Updated on 22 Oct 2026
Careful: v2.15.4+incompatible has 16 known vulnerabilities, and 3 have no fix yet. Use an earlier safe version, or the workaround listed for each one.
- Security Some issues to review
- Maintenance Sustainable
- Popularity Key ecosystem project
- Community Active
The current release has a vulnerability with no published fix, which caps this score.
What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →
- Current release v2.15.4+incompatible — affected i
- Vulnerabilities on record 41 over 4 years · 4 in the last year i
- Latest disclosure 02 Apr 2026 i
- Highest CVSS 9.4 i
- With no published fix 3 i
- Stars 29,588 i
- OpenSSF scorecard 7/10 i
- Last release this month i
- Licence Apache-2.0 i
Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Versions
Which versions are affected
Every version Vulert tracks for github.com/goharbor/harbor, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.
- v0.0.0-20261014105100-5bdb8a678fa1 14 Oct 2026
- v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible 14 Oct 2026
- v0.0.0-20261014094424-79c614d02652 14 Oct 2026
- v2.4.0-rc1.0.20261014094424-79c614d02652+incompatible 14 Oct 2026
- v0.0.0-20261014045114-96387e302466 14 Oct 2026
- v2.4.0-rc1.0.20261014045114-96387e302466+incompatible 14 Oct 2026
- v0.0.0-20261013114336-35dd9e4337ca 13 Oct 2026
- v2.4.0-rc1.0.20261013114336-35dd9e4337ca+incompatible 13 Oct 2026
- v0.0.0-20261013094133-5c885152b973 13 Oct 2026
- v2.4.0-rc1.0.20261013094133-5c885152b973+incompatible 13 Oct 2026
- v2.14.6-rc1+incompatible 13 Oct 2026
- v0.0.0-20261012100429-23bfa9a110e0 12 Oct 2026
- v2.4.0-rc1.0.20261012100429-23bfa9a110e0+incompatible 12 Oct 2026
- v0.0.0-20261012072144-205159bd9158 12 Oct 2026
- v2.4.0-rc1.0.20261012072144-205159bd9158+incompatible 12 Oct 2026
- v0.0.0-20261012062824-2c94d4e213b0 12 Oct 2026
- v2.4.0-rc1.0.20261012062824-2c94d4e213b0+incompatible 12 Oct 2026
- v0.0.0-20261010031320-2c66bbe03245 10 Oct 2026
- v2.4.0-rc1.0.20261010031320-2c66bbe03245+incompatible 10 Oct 2026
- v0.0.0-20261009084209-4d425b805f31 09 Oct 2026
- v2.4.0-rc1.0.20261009084209-4d425b805f31+incompatible 09 Oct 2026
- v0.0.0-20261009021507-0a6bf30d54e7 09 Oct 2026
- v2.15.4+incompatible 09 Oct 2026
- v0.0.0-20261008103919-44d081c19570 08 Oct 2026
- v2.4.0-rc1.0.20261008103919-44d081c19570+incompatible 08 Oct 2026
- v2.15.4-rc1+incompatible 08 Oct 2026
- v0.0.0-20261008082647-c329590590b2 08 Oct 2026
- v2.4.0-rc1.0.20261008082647-c329590590b2+incompatible 08 Oct 2026
- v0.0.0-20261008065112-72e54002bb76 08 Oct 2026
- v2.4.0-rc1.0.20261008065112-72e54002bb76+incompatible 08 Oct 2026
- v0.0.0-20261008060913-8b67a48c4e7f 08 Oct 2026
- v2.4.0-rc1.0.20261008060913-8b67a48c4e7f+incompatible 08 Oct 2026
- v0.0.0-20261008043408-ba53f0bb10f8 08 Oct 2026
- v2.4.0-rc1.0.20261008043408-ba53f0bb10f8+incompatible 08 Oct 2026
- v0.0.0-20261008014515-f6f5bac8d1c0 08 Oct 2026
- v2.4.0-rc1.0.20261008014515-f6f5bac8d1c0+incompatible 08 Oct 2026
- v0.0.0-20261007155749-c983fe4f70ad 07 Oct 2026
- v0.0.0-20261007120417-9a37bcf55fcb 07 Oct 2026
- v2.4.0-rc1.0.20261007120417-9a37bcf55fcb+incompatible 07 Oct 2026
- v2.14.5+incompatible 06 Oct 2026
- v0.0.0-20261006150422-4efe985802ed 06 Oct 2026
- v2.13.6+incompatible 06 Oct 2026
- v2.15.3+incompatible 06 Oct 2026
- v0.0.0-20261006120435-b323c0c8ec89 06 Oct 2026
- v2.4.0-rc1.0.20261006120435-b323c0c8ec89+incompatible 06 Oct 2026
- v2.4.0-rc1.0.20261006120335-f234c0cb686e+incompatible 06 Oct 2026
- v0.0.0-20261005003925-721c6d48d9da 05 Oct 2026
- v2.4.0-rc1.0.20261005003925-721c6d48d9da+incompatible 05 Oct 2026
- v0.0.0-20261004215446-1f54a55a2bf4 04 Oct 2026
- v2.4.0-rc1.0.20261004215446-1f54a55a2bf4+incompatible 04 Oct 2026
- v0.0.0-20261004194917-3f56f04403bd 04 Oct 2026
- v2.4.0-rc1.0.20261004194917-3f56f04403bd+incompatible 04 Oct 2026
- v0.0.0-20261001061438-f25e9dafbfb2 01 Oct 2026
- v2.4.0-rc1.0.20261001061438-f25e9dafbfb2+incompatible 01 Oct 2026
- v0.0.0-20260929115123-37dc02fdff10 29 Sep 2026
- v2.4.0-rc1.0.20260929115123-37dc02fdff10+incompatible 29 Sep 2026
- v0.0.0-20260928124057-d3e2ad0a395c 28 Sep 2026
- v2.4.0-rc1.0.20260928124057-d3e2ad0a395c+incompatible 28 Sep 2026
- v0.0.0-20260928093239-4067002f889e 28 Sep 2026
- v2.4.0-rc1.0.20260928093239-4067002f889e+incompatible 28 Sep 2026
- v0.0.0-20260928074754-3d6998576319 28 Sep 2026
- v2.4.0-rc1.0.20260928074754-3d6998576319+incompatible 28 Sep 2026
- v0.0.0-20260928031627-ba6e562714af 28 Sep 2026
- v2.4.0-rc1.0.20260928031627-ba6e562714af+incompatible 28 Sep 2026
- v0.0.0-20260924043329-e5e0e72c7455 24 Sep 2026
- v2.4.0-rc1.0.20260924043329-e5e0e72c7455+incompatible 24 Sep 2026
- v2.15.3-rc2+incompatible 23 Sep 2026
- v0.0.0-20260923080500-51e66ab76be6 23 Sep 2026
- v2.4.0-rc1.0.20260923080500-51e66ab76be6+incompatible 23 Sep 2026
- v0.0.0-20260922052319-ab9e0805a4ba 22 Sep 2026
- v2.4.0-rc1.0.20260922052319-ab9e0805a4ba+incompatible 22 Sep 2026
- v0.0.0-20260921222600-ce615fd58466 21 Sep 2026
- v2.4.0-rc1.0.20260921222600-ce615fd58466+incompatible 21 Sep 2026
- v0.0.0-20260921091320-6d24f6c57685 21 Sep 2026
- v2.4.0-rc1.0.20260921091320-6d24f6c57685+incompatible 21 Sep 2026
- v0.0.0-20260921082046-21a0d0ad66a4 21 Sep 2026
- v2.4.0-rc1.0.20260921082046-21a0d0ad66a4+incompatible 21 Sep 2026
- v0.0.0-20260921023415-d151832b626f 21 Sep 2026
- v2.4.0-rc1.0.20260921023415-d151832b626f+incompatible 21 Sep 2026
- v0.0.0-20260918062859-65c5f4c0d7ae 18 Sep 2026
- v2.4.0-rc1.0.20260918062859-65c5f4c0d7ae+incompatible 18 Sep 2026
- v0.0.0-20260917191524-1f960cce35be 17 Sep 2026
- v2.4.0-rc1.0.20260917191524-1f960cce35be+incompatible 17 Sep 2026
- v0.0.0-20260917182253-14f7a5314681 17 Sep 2026
- v2.4.0-rc1.0.20260917182253-14f7a5314681+incompatible 17 Sep 2026
- v0.0.0-20260917090310-6a1f61c455a5 17 Sep 2026
- v2.4.0-rc1.0.20260917090310-6a1f61c455a5+incompatible 17 Sep 2026
- v0.0.0-20260916083353-eadf89a5fb35 16 Sep 2026
- v2.4.0-rc1.0.20260916083353-eadf89a5fb35+incompatible 16 Sep 2026
- v0.0.0-20260916074122-de749f4e50c6 16 Sep 2026
- v2.4.0-rc1.0.20260916074122-de749f4e50c6+incompatible 16 Sep 2026
- v0.0.0-20260916021458-b5a7917f8f8c 16 Sep 2026
- v2.4.0-rc1.0.20260916021458-b5a7917f8f8c+incompatible 16 Sep 2026
- v0.0.0-20260916013047-482bb0ef798a 16 Sep 2026
- v2.4.0-rc1.0.20260916013047-482bb0ef798a+incompatible 16 Sep 2026
- v0.0.0-20260915125630-ca62147639fe 15 Sep 2026
- v2.4.0-rc1.0.20260915125630-ca62147639fe+incompatible 15 Sep 2026
- v0.0.0-20260915120651-e550f89cbe1a 15 Sep 2026
- v0.0.0-20260915095010-e85da841d06b 15 Sep 2026
- v2.4.0-rc1.0.20260915095010-e85da841d06b+incompatible 15 Sep 2026
- v0.0.0-20260915075547-17b07334f943 15 Sep 2026
- v2.4.0-rc1.0.20260915075547-17b07334f943+incompatible 15 Sep 2026
- v0.0.0-20260915045701-c10a0a62ce57 15 Sep 2026
- v2.4.0-rc1.0.20260915045701-c10a0a62ce57+incompatible 15 Sep 2026
- v0.0.0-20260915032400-8ca2cc23229e 15 Sep 2026
- v2.4.0-rc1.0.20260915032400-8ca2cc23229e+incompatible 15 Sep 2026
- v0.0.0-20260914095520-809db36ae94a 14 Sep 2026
- v2.4.0-rc1.0.20260914095520-809db36ae94a+incompatible 14 Sep 2026
- v0.0.0-20260914063252-3488b6455a7a 14 Sep 2026
- v2.4.0-rc1.0.20260914063252-3488b6455a7a+incompatible 14 Sep 2026
- v0.0.0-20260911072126-fb6f06b6cc5a 11 Sep 2026
- v2.4.0-rc1.0.20260911072126-fb6f06b6cc5a+incompatible 11 Sep 2026
- v2.15.3-rc1+incompatible 10 Sep 2026
- v0.0.0-20260910130106-95b28b3cd48e 10 Sep 2026
- v2.4.0-rc1.0.20260910130106-95b28b3cd48e+incompatible 10 Sep 2026
- v0.0.0-20260910084859-5ed6b1306613 10 Sep 2026
- v2.4.0-rc1.0.20260910084859-5ed6b1306613+incompatible 10 Sep 2026
- v0.0.0-20260910060850-6084e31d1651 10 Sep 2026
- v2.4.0-rc1.0.20260910060850-6084e31d1651+incompatible 10 Sep 2026
- v0.0.0-20260910031931-3a949807e41b 10 Sep 2026
The newest 120 of 12,262 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.
02 Disclosure history
How often vulnerabilities are recorded
Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 4 of the 41 were recorded in the last 12 months.
03 Vulnerabilities
Recorded vulnerabilities for github.com/goharbor/harbor
| Vulnerability | Severity | Fixed version ↓ | Disclosed ↓ |
|---|---|---|---|
| CVE-2026-4404: GoHarbor Harbor Default Password Vulnerability | 9.4 critical | No fix published | 23 Mar 2026 |
| CVE-2019-19023: Privilege Escalation in Cloud Native Computing Foundation Harbor | 9.3 medium | 1.8.6 | 18 May 2021 |
| CVE-2022-31670: Harbor Fails to Validate User Permissions When Updating Tag Retention Policies | 7.7 high | 1.10.13 | 16 Sep 2022 |
| CVE-2022-31666: Harbor Webhook Policies User Permissions Validation Failure | 7.7 high | 1.10.13 | 16 Sep 2022 |
| CVE-2019-19025: Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor | 7.6 high | 1.8.6 | 18 May 2021 |
Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback
Updated: 22/Oct/2026 · Vulnerabilities in our DB: 524173
