GHSA-prh4-vhfh-24mj Harbor: LDAP password and OIDC secret are not redacted in the audit log
Harbor logs unredacted LDAP passwords and OIDC secrets in audit logs, allowing privileged users to read sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-prh4-vhfh-24mj?
GHSA-prh4-vhfh-24mj is a vulnerability in github.com/goharbor/harbor, published on 26 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Impact
Harbor write configuration payload to audit log when configuration change, the ldap_search_password and oidc_client_secret will be logged in the audit log without redacted
Patches
Harbor v2.15.0, v2.14.3, v2.13.5
Workarounds
Disable audit log configure event in Harbor Web Console: Go to Administration -> Configuration -> Enable Audit Log Event Type -> Uncheck "Update Configuration" and click "Save" Button.
Which versions are affected by GHSA-prh4-vhfh-24mj?
5 open source packages ship an affected version, including github.com/goharbor/harbor.
| Package | Affected | Fixed in |
|---|---|---|
github.com/goharbor/harbor Go | From 2.13.0 | 2.13.5 |
github.com/goharbor/harbor Go | From 2.13.0 | 2.13.5 |
github.com/goharbor/harbor Go | From 2.13.0+incompatible | 2.13.5+incompatible, 2.14.3+incompatible |
github.com/goharbor/harbor Go | From 2.14.0 | 2.14.3 |
github.com/goharbor/harbor Go | From 2.14.0 | 2.14.3 |
How do I fix GHSA-prh4-vhfh-24mj?
Upgrade github.com/goharbor/harbor to a fixed version for your release line: 2.13.5, 2.13.5+incompatible, 2.14.3+incompatible or 2.14.3.
Is GHSA-prh4-vhfh-24mj being exploited?
There is no known exploitation of GHSA-prh4-vhfh-24mj in the wild and no public exploit code.
Sources
Also known as GO-2026-4876.