CVE-2025-30086: 
Harbor vulnerability analysis and mitigation

CVE-2025-30086 affects CNCF Harbor versions 2.13.x before 2.13.1 and 2.12.x before 2.12.4. The vulnerability was discovered and disclosed on July 25, 2025, and involves an information disclosure vulnerability that allows administrators to exploit an ORM Leak in the /api/v2.0/users endpoint (GHSA Advisory).

The vulnerability exists in the q URL parameter functionality which allows administrators to filter users by any column. The parameter could be abused to leak users' password hash and salt values character by character using the filter password=~ parameter. The vulnerability has been assigned a CVSS v3.1 base score of 4.9 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with high privileges required (NVD).

An attacker with administrator access could exploit this vulnerability to leak highly sensitive information stored in the Harbor database, specifically users' password hash and salt values. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack (GHSA Advisory).

The vulnerability requires administrator privileges to exploit. The attack vector involves using the q URL parameter to filter users by column values, allowing an attacker to leak password hashes character by character through the filter password=~ parameter (GHSA Advisory).

The vulnerability has been patched in Harbor versions 2.13.1 and 2.12.4. Users are advised to upgrade to these or newer versions to mitigate the risk (Harbor Releases).