CVE-2026-4404: 
Harbor vulnerability analysis and mitigation

CVE-2026-4404 is a hard-coded credentials vulnerability in GoHarbor Harbor (versions 2.15.0 and below) that allows unauthenticated remote attackers to authenticate to the web UI using the publicly known default administrator credentials (admin / Harbor12345). The vulnerability was publicly disclosed on March 24, 2026, and was reported by researcher notnotnotveg via CERT/CC. It carries a CVSS v3.1 base score of 9.4 (Critical) (CERT/CC VU#577436, Feedly).

The root cause is classified as CWE-798 (Use of Hard-coded Credentials) and more specifically CWE-1393 (Use of Default Password). Harbor ships with a default administrator account (admin) and password (Harbor12345) configured via the harbor_admin_password parameter in harbor.yml. The installation process does not enforce a password change during setup or upon first login, meaning any deployment where the operator has not manually updated this value remains vulnerable. The issue was first raised as a GitHub issue (#1937) in April 2017 and remained unresolved through version 2.15.0; a proposed fix (PR #22751) adds an interactive password prompt during installation and comments out the default password line in the configuration template (CERT/CC VU#577436, GitHub PR #22751, CWE-1393).

An attacker who authenticates with the default credentials gains full administrative access to the Harbor registry, enabling supply-chain attacks through overwriting or injecting malicious container images into CI/CD pipelines and Kubernetes environments. The attacker can establish persistent access by creating new users, robot accounts, or API tokens, and can disable security controls such as vulnerability scanning and signature enforcement. Additional impacts include exfiltration of sensitive container images via replication to external registries, deletion of repositories, and corruption of artifacts resulting in service disruption (CERT/CC VU#577436).

No public proof-of-concept exploit code has been observed, and there is no confirmed evidence of in-the-wild exploitation at the time of disclosure. However, the CERT/CC reporter noted that default username/password scanning against Harbor instances was observed as an active threat on their honeypot, indicating opportunistic scanning activity. The EPSS score is approximately 0.04%, reflecting low but non-zero exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog. Qualys has detection signatures for this vulnerability (detection IDs 5009612 and 761875) (CERT/CC VU#577436, GitHub PR #22751, Feedly).

1. Reconnaissance: Use tools such as Shodan or Censys to identify internet-facing Harbor registry instances (typically exposed on port 80/443) running version 2.15.0 or below.
2. Identify default credential exposure: Confirm the target is running Harbor by checking the web UI login page (e.g., https://<target>/harbor/sign-in) and reviewing publicly available Harbor documentation confirming the default credentials (admin / Harbor12345).
3. Authenticate with default credentials: Submit a login request to the Harbor web UI or API endpoint (e.g., POST /c/login or GET /api/v2.0/users with HTTP Basic Auth) using admin:Harbor12345.
4. Achieve administrative access: Upon successful authentication, access the full Harbor admin panel to manage repositories, users, robot accounts, replication rules, and security settings.
5. Conduct post-exploitation: Push malicious container images to repositories, configure replication to exfiltrate images to an attacker-controlled registry, create persistent robot accounts or API tokens, or disable vulnerability scanning and signature enforcement to facilitate downstream supply-chain attacks (CERT/CC VU#577436, GitHub PR #22751).

• Network: Successful authentication requests to the Harbor login endpoint (/c/login or /api/v2.0/users) from unexpected or external IP addresses using the admin account; outbound replication traffic to unknown external registries.
• Logs: Harbor access logs showing successful admin logins from unfamiliar source IPs; audit log entries for creation of new users, robot accounts, or API tokens shortly after an admin login; log entries for changes to replication rules or security policy modifications.
• Application: Unexpected new user accounts, robot accounts, or API tokens in the Harbor admin panel; newly created or modified replication endpoints pointing to external registries; disabled vulnerability scanning or content trust settings.
• Container Registry: Presence of unexpected or modified container images in repositories; image tags that do not match expected build pipeline outputs (CERT/CC VU#577436).

The primary remediation is to immediately change the default Harbor administrator password either before or immediately after deployment, via the Harbor web interface or by specifying a unique value for harbor_admin_password in harbor.yml during installation. A patch is proposed in Harbor PR #22751 (targeting v2.16.0) that removes the hardcoded default password from the configuration template and adds an interactive password prompt during installation; operators should monitor the Harbor release for version 2.15.1 or later incorporating this fix. As an interim workaround, restrict network access to the Harbor web UI through firewall rules or network segmentation to trusted IP addresses only, and review access logs for unauthorized authentication attempts using default credentials (CERT/CC VU#577436, GitHub PR #22751).

CERT/CC published vulnerability note VU#577436 on March 24, 2026, crediting researcher notnotnotveg and noting that the Harbor vendor stated they consider themselves "Not Affected" as of January 19, 2026, though no formal vendor statement was provided. The issue received coverage from GBHackers, SecurityOnline, CyberPress, and The Hacker News weekly recap, with the Belgium Centre for Cybersecurity (CCB) issuing a warning advisory urging immediate patching. Community discussion on Reddit (r/pwnhub) highlighted the long-standing nature of the issue, which was originally raised as a GitHub issue in April 2017 and remained unaddressed for nearly a decade (CERT/CC VU#577436, GitHub PR #22751, GBHackers, SecurityOnline).