Hard-coded credentials in backstage Harbor
Priority MEDIUM 47CWE-1393Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-798.
Summary
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00499 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | Harbor | 0.1.0 – 2.15.0 | — | No fix listed | CNA |
| — | github.com/goharbor/harbor (Go) | up to 2.15.0 | — | No fix listed | GHSA-hj7x-hmf2-hc2p |
- Harbor Vendorbackstage Affected 0.1.0 – 2.15.0 Fixed in — No fix listed CNA
- github.com/goharbor/harbor (Go) Vendor— Affected up to 2.15.0 Fixed in — No fix listed GHSA-hj7x-hmf2-hc2p
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4404
- 2026-10-03 Alias added: GHSA-hj7x-hmf2-hc2p
References
Other 5
- https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345
- https://github.com/goharbor/harbor/issues/1937
- https://cwe.mitre.org/data/definitions/1393.html
- https://github.com/goharbor/harbor/pull/22751
- https://github.com/goharbor/harbor
More backstage Harbor vulnerabilities
- TI-2019-13717 Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows… CVSS 3.1MEDIUM 5.3
- TI-2019-12090 core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin… CVSS 3.1MEDIUM 6.5
- TI-2022-22962 An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and… CVSS 3.1HIGH 7.5
- TI-2019-13713 Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege… CVSS 3.1HIGH 8.8
- TI-2019-13714 Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the… CVSS 3.1HIGH 8.8
- TI-2017-12953 The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the… CVSS 3.1HIGH 8.6
Sources
- CVE-2026-4404 · CVE Program
- CVE-2026-4404 · NVD
- FIRST EPSS
- GHSA-hj7x-hmf2-hc2p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences