Harbor: LDAP password and OIDC secret are not redacted in the audit log
Priority LOW 38CWE-312Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-312.
Summary
### Impact Harbor write configuration payload to audit log when configuration change, the ldap_search_password and oidc_client_secret will be logged in the audit log without redacted ### Patches Harbor v2.15.0, v2.14.3, v2.13.5 ### Workarounds Disable audit log configure event in Harbor Web Console: Go to Administration -> Configuration -> Enable Audit Log Event Type -> Uncheck "Update Configuration" and click "Save" Button.
Why it matters now
Fix Fixed github.com/goharbor/harbor (Go): 2.13.5, 2.14.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/goharbor/harbor (Go) | 2.13.0 to before 2.13.5 | 2.13.5 | Patch available | GHSA-prh4-vhfh-24mj |
| — | github.com/goharbor/harbor (Go) | 2.14.0 to before 2.14.3 | 2.14.3 | Patch available | GHSA-prh4-vhfh-24mj |
- github.com/goharbor/harbor (Go) Vendor— Affected 2.13.0 to before 2.13.5 Fixed in 2.13.5 Patch available GHSA-prh4-vhfh-24mj
- github.com/goharbor/harbor (Go) Vendor— Affected 2.14.0 to before 2.14.3 Fixed in 2.14.3 Patch available GHSA-prh4-vhfh-24mj
Remediation
- Fix · GHSA-prh4-vhfh-24mj github.com/goharbor/harbor (Go) Fixed in 2.13.5 Advisory →
- Fix · GHSA-prh4-vhfh-24mj github.com/goharbor/harbor (Go) Fixed in 2.14.3 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-prh4-vhfh-24mj
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences