CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter
Project administrators can recover scanner adapter secrets via fuzzy filtering on query parameters, exposing sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92770?
CVE-2026-92770 is a high-severity vulnerability in goharbor harbor, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts.
Weakness: CWE-200
Which versions are affected by CVE-2026-92770?
How do I fix CVE-2026-92770?
No fix has been published for CVE-2026-92770 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92770 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92770 exists.
Sources
Also known as GHSA-3j3m-qx68-6ww6.