Open-source package vulnerability · Go
CVE-2026-4404: Harbor allows the use of the default password for web UI login
criticalCVSS 3.1 9.4GHSA-hj7x-hmf2-hc2p
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
Published Mar 23, 2026 · Updated Mar 25, 2026
Affected packages
github.com/goharbor/harbor
- Ecosystem
- Go
- Affected
- <= 2.15.0
- Fixed in
- No patched version yet
- Check
go list -m github.com/goharbor/harbor
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-4404
- https://github.com/goharbor/harbor/issues/1937
- https://github.com/goharbor/harbor/pull/22751
- https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345
- https://www.kb.cert.org/vuls/id/577436
- https://github.com/advisories/GHSA-hj7x-hmf2-hc2p
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology