CVE-2025-30086 Possible ORM Leak Vulnerability in the Harbor
Administrators can exploit an ORM leak in the users API to extract password hashes and salts from the database.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30086?
CVE-2025-30086 is a medium-severity vulnerability in n/a, published on 25 Jul 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user's password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack.
Weakness: CWE-200
Which versions are affected by CVE-2025-30086?
7 open source packages ship an affected version, including github.com/goharbor/harbor.
| Package | Affected | Fixed in |
|---|---|---|
github.com/goharbor/harbor Go | All versions | 2.12.4+incompatible, 2.13.1+incompatible |
github.com/goharbor/harbor Go | All versions | 2.4.0-rc1.0.20250331071157-dce7d9f5cffb |
github.com/goharbor/harbor Go | All versions | 2.4.0-rc1.0.20250331071157-dce7d9f5cffb |
github.com/goharbor/harbor Go | From 2.13.0 | 2.13.1 |
github.com/goharbor/harbor Go | From 2.13.0 | 2.13.1 |
github.com/goharbor/harbor Go | From 2.4.0-rc1.1 | 2.12.4 |
1 more packages
github.com/goharbor/harbor Go | From 2.4.0-rc1.1 | 2.12.4 |
How do I fix CVE-2025-30086?
Upgrade github.com/goharbor/harbor to a fixed version for your release line: 2.12.4+incompatible, 2.13.1+incompatible, 2.4.0-rc1.0.20250331071157-dce7d9f5cffb or 2.13.1.
Is CVE-2025-30086 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-30086 exists.
Sources
Also known as GHSA-h27m-3qw8-3pw8, GO-2025-3826.