Read the docs
TI-2024-14833 Aliases CVE-2024-22244GHSA-5757-v49g-f6r7

Harbor Open Redirect URL

Priority LOW 27CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Open Redirect in Harbor  <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Fixed github.com/goharbor/harbor (Go): 2.8.5, 2.9.3, 2.10.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstageHarbor2.8 – 2.8.4; 2.10 – 2.10.0—No fix listedCNA
—github.com/goharbor/harbor (Go)before 2.8.52.8.5Patch availableGHSA-5757-v49g-f6r7
—github.com/goharbor/harbor (Go)2.9.0 to before 2.9.32.9.3Patch availableGHSA-5757-v49g-f6r7
—github.com/goharbor/harbor (Go)2.10.0 to before 2.10.12.10.1Patch availableGHSA-5757-v49g-f6r7
  • Harbor Vendorbackstage Affected 2.8 – 2.8.4; 2.10 – 2.10.0 Fixed in — No fix listed CNA
  • github.com/goharbor/harbor (Go) Vendor— Affected before 2.8.5 Fixed in 2.8.5 Patch available GHSA-5757-v49g-f6r7
  • github.com/goharbor/harbor (Go) Vendor— Affected 2.9.0 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-5757-v49g-f6r7
  • github.com/goharbor/harbor (Go) Vendor— Affected 2.10.0 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-5757-v49g-f6r7

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*2.8.0 to before 2.8.5; 2.9.0 to before 2.9.3Vulnerablebackstage
cpe:2.3:a:linuxfoundation:harbor:2.10.0:-:*:*:*:*:*:*2.10.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:* Versions 2.8.0 to before 2.8.5; 2.9.0 to before 2.9.3 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:harbor:2.10.0:-:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·backstage

Remediation

  • Fix · GHSA-5757-v49g-f6r7 github.com/goharbor/harbor (Go) Fixed in 2.8.5 Advisory →
  • Fix · GHSA-5757-v49g-f6r7 github.com/goharbor/harbor (Go) Fixed in 2.9.3 Advisory →
  • Fix · GHSA-5757-v49g-f6r7 github.com/goharbor/harbor (Go) Fixed in 2.10.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22244
  2. 2026-10-03 Alias added: GHSA-5757-v49g-f6r7

References

Advisory 2

Other 2

  • TI-2019-13717 Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows… CVSS 3.1MEDIUM 5.3
  • TI-2019-12090 core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin… CVSS 3.1MEDIUM 6.5
  • TI-2022-22962 An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and… CVSS 3.1HIGH 7.5
  • TI-2026-03829 Hard-coded credentials in backstage Harbor CVSS 3.1CRITICAL 9.4
  • TI-2019-13713 Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege… CVSS 3.1HIGH 8.8
  • TI-2019-13714 Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the… CVSS 3.1HIGH 8.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences