CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor
Attackers can use hardcoded default credentials to gain unauthorized access to the Harbor web UI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4404?
CVE-2026-4404 is a critical vulnerability in Harbor, published on 23 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
Which versions are affected by CVE-2026-4404?
4 open source packages ship an affected version, including github.com/goharbor/harbor and harbor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/goharbor/harbor Go | All versions | None |
github.com/goharbor/harbor Go | All versions to 2.15.0 | None |
github.com/goharbor/harbor Go | All versions to 2.15.0 | None |
harbor Bitnami | All versions | 2.15.1 |
Products include Linuxfoundation Harbor.
How do I fix CVE-2026-4404?
Upgrade to a fixed version.
Is CVE-2026-4404 being exploited?
There is no known exploitation of CVE-2026-4404 in the wild and no public exploit code.
Other vulnerabilities in Harbor
- CVE-2019-19023 Privilege Escalation in Cloud Native Computing Foundation Harbor
- CVE-2019-19025 Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor
- CVE-2017-17697 Server-side request forgery in n/a
- CVE-2022-31666 Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies
- CVE-2022-31670 Harbor fails to validate the user permissions when updating tag retention policies
Sources
Also known as BIT-harbor-2026-4404, GHSA-hj7x-hmf2-hc2p, GO-2026-4845, MINI-45r2-pq6p-xfxc, MINI-q8pw-85vj-chmc.