github.com/goharbor/harbor (Go)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 2.14.3 or later clears every advisory below that has a fix.

Upgrade commands

go get github.com/goharbor/harbor@v2.14.3 && go mod tidy

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-prh4-vhfh-24mj Harbor: LDAP password and OIDC secret are not redacted in the audit log	Medium	`>= 2.14.0, < 2.14.3`	`2.14.3`
GHSA-prh4-vhfh-24mj Harbor: LDAP password and OIDC secret are not redacted in the audit log	Medium	`>= 2.13.0, < 2.13.5`	`2.13.5`
GHSA-prh4-vhfh-24mj Harbor: LDAP password and OIDC secret are not redacted in the audit log	Medium	`>= 2.13.0+incompatible, < 2.13.5+incompatible` `>= 2.14.0+incompatible, < 2.14.3+incompatible`	`2.13.5+incompatible` `2.14.3+incompatible`
GHSA-hj7x-hmf2-hc2p Harbor allows the use of the default password for web UI login	Critical EPSS 0.50%	`<= 2.15.0`	No fix yet
GHSA-hj7x-hmf2-hc2p Harbor allows the use of the default password for web UI login	Critical EPSS 0.50%	`all versions`	No fix yet
GHSA-h27m-3qw8-3pw8 Possible ORM Leak Vulnerability in the Harbor	Medium EPSS 0.71%	`>= 2.4.0-rc1.1, < 2.12.4`	`2.12.4`
GHSA-h27m-3qw8-3pw8 Possible ORM Leak Vulnerability in the Harbor	Medium EPSS 0.71%	`>= 2.13.0, < 2.13.1`	`2.13.1`
GHSA-h27m-3qw8-3pw8 Possible ORM Leak Vulnerability in the Harbor	Medium EPSS 0.71%	`< 2.12.4+incompatible` `>= 2.13.0+incompatible, < 2.13.1+incompatible`	`2.12.4+incompatible` `2.13.1+incompatible`
GHSA-h27m-3qw8-3pw8 Possible ORM Leak Vulnerability in the Harbor	Medium EPSS 0.71%	`< 2.4.0-rc1.0.20250331071157-dce7d9f5cffb`	`2.4.0-rc1.0.20250331071157-dce7d9f5cffb`
GHSA-f9vc-vf3r-pqqq Harbor repository description page has Cross-site Scripting vulnerability	Medium EPSS 0.37%	`>= 2.4.0-rc1.1, <= 2.11.2`	No fix yet
GHSA-f9vc-vf3r-pqqq Harbor repository description page has Cross-site Scripting vulnerability	Medium EPSS 0.37%	`>= 2.13.0-rc1, < 2.13.1-rc1`	`2.13.1-rc1`
GHSA-f9vc-vf3r-pqqq Harbor repository description page has Cross-site Scripting vulnerability	Medium EPSS 0.37%	`>= 2.12.0-rc1, < 2.12.4-rc1`	`2.12.4-rc1`
GHSA-f9vc-vf3r-pqqq Harbor repository description page has Cross-site Scripting vulnerability	Medium EPSS 0.37%	`< 2.4.0-rc1.0.20250421072404-a13a16383a41`	`2.4.0-rc1.0.20250421072404-a13a16383a41`
GHSA-f9vc-vf3r-pqqq Harbor repository description page has Cross-site Scripting vulnerability	Medium EPSS 0.37%	`>= 2.13.0-rc1+incompatible, < 2.13.1-rc1+incompatible`	`2.13.1-rc1+incompatible`
GHSA-f9vc-vf3r-pqqq Harbor repository description page has Cross-site Scripting vulnerability	Medium EPSS 0.37%	`>= 2.12.0-rc1+incompatible, < 2.12.4-rc1+incompatible`	`2.12.4-rc1+incompatible`
GHSA-f9vc-vf3r-pqqq Harbor repository description page has Cross-site Scripting vulnerability	Medium EPSS 0.37%	`all versions`	No fix yet
GHSA-r864-28pw-8682 Harbor fails to validate the user permissions when updating p2p preheat policies	High EPSS 0.30%	`>= 2.0.0, < 2.4.3`	`2.4.3`
GHSA-r864-28pw-8682 Harbor fails to validate the user permissions when updating p2p preheat policies	High EPSS 0.30%	`>= 2.5.0, < 2.5.2`	`2.5.2`
GHSA-r864-28pw-8682 Harbor fails to validate the user permissions when updating p2p preheat policies	High EPSS 0.30%	`>= 2.0.0+incompatible, < 2.4.3+incompatible` `>= 2.5.0+incompatible, < 2.5.2+incompatible`	`2.4.3+incompatible` `2.5.2+incompatible`
GHSA-hw28-333w-qxp3 Harbor fails to validate the user permissions when updating project configurations	Medium EPSS 0.36%	`>= 2.10.0, < 2.10.3`	`2.10.3`
GHSA-hw28-333w-qxp3 Harbor fails to validate the user permissions when updating project configurations	Medium EPSS 0.36%	`< 2.9.5+incompatible` `>= 2.10.0+incompatible, < 2.10.3+incompatible`	`2.9.5+incompatible` `2.10.3+incompatible`
GHSA-hw28-333w-qxp3 Harbor fails to validate the user permissions when updating project configurations	Medium EPSS 0.36%	`< 2.9.5`	`2.9.5`
GHSA-vw63-824v-qf2j SQL Injection in Harbor scan log API	Medium EPSS 0.42%	`< 2.8.6+incompatible` `>= 2.9.0+incompatible, < 2.9.4+incompatible` `>= 2.10.0+incompatible, < 2.10.2+incompatible`	`2.8.6+incompatible` `2.9.4+incompatible` `2.10.2+incompatible`
GHSA-vw63-824v-qf2j SQL Injection in Harbor scan log API	Medium EPSS 0.42%	`< 2.8.6`	`2.8.6`
GHSA-vw63-824v-qf2j SQL Injection in Harbor scan log API	Medium EPSS 0.42%	`>= 2.9.0, < 2.9.4`	`2.9.4`
GHSA-vw63-824v-qf2j SQL Injection in Harbor scan log API	Medium EPSS 0.42%	`>= 2.10.0, < 2.10.2`	`2.10.2`
GHSA-5757-v49g-f6r7 Open Redirect URL in Harbor	Medium EPSS 0.36%	`< 2.8.5+incompatible` `>= 2.9.0+incompatible, < 2.9.3+incompatible` `>= 2.10.0+incompatible, < 2.10.1+incompatible`	`2.8.5+incompatible` `2.9.3+incompatible` `2.10.1+incompatible`
GHSA-5757-v49g-f6r7 Open Redirect URL in Harbor	Medium EPSS 0.36%	`< 2.8.5`	`2.8.5`
GHSA-5757-v49g-f6r7 Open Redirect URL in Harbor	Medium EPSS 0.36%	`>= 2.9.0, < 2.9.3`	`2.9.3`
GHSA-5757-v49g-f6r7 Open Redirect URL in Harbor	Medium EPSS 0.36%	`>= 2.10.0, < 2.10.1`	`2.10.1`
GHSA-mq6f-5xh5-hgcf Harbor timing attack risk	Medium EPSS 0.45%	`>= 2.0.0, < 2.7.3`	`2.7.3`
GHSA-mq6f-5xh5-hgcf Harbor timing attack risk	Medium EPSS 0.45%	`< 1.10.18` `>= 2.0.0+incompatible, < 2.7.3+incompatible` `>= 2.8.0+incompatible, < 2.8.3+incompatible`	`1.10.18` `2.7.3+incompatible` `2.8.3+incompatible`
GHSA-mq6f-5xh5-hgcf Harbor timing attack risk	Medium EPSS 0.45%	`>= 2.8.0, < 2.8.3`	`2.8.3`
GHSA-mq6f-5xh5-hgcf Harbor timing attack risk	Medium EPSS 0.45%	`< 1.10.18`	`1.10.18`
GHSA-xx9w-464f-7h6f Harbor fails to validate the user permissions when updating a robot account	Medium EPSS 0.52%	`>= 1.0.0, < 1.10.13`	`1.10.13`
GHSA-xx9w-464f-7h6f Harbor fails to validate the user permissions when updating a robot account	Medium EPSS 0.52%	`>= 2.5.0, < 2.5.2`	`2.5.2`
GHSA-xx9w-464f-7h6f Harbor fails to validate the user permissions when updating a robot account	Medium EPSS 0.52%	`>= 2.0.0, < 2.4.3`	`2.4.3`
GHSA-8c6p-v837-77f6 Harbor fails to validate the user permissions when updating tag immutability policies	High EPSS 0.41%	`>= 2.5.0, < 2.5.2`	`2.5.2`
GHSA-8c6p-v837-77f6 Harbor fails to validate the user permissions when updating tag immutability policies	High EPSS 0.41%	`>= 1.0.0, < 1.10.13`	`1.10.13`
GHSA-8c6p-v837-77f6 Harbor fails to validate the user permissions when updating tag immutability policies	High EPSS 0.41%	`>= 2.0.0, < 2.4.3`	`2.4.3`
GHSA-jf8p-3vjh-pq94 Harbor fails to validate the user permissions when viewing Webhook policies	Medium EPSS 0.50%	`>= 1.0.0, < 1.10.13`	`1.10.13`
GHSA-jf8p-3vjh-pq94 Harbor fails to validate the user permissions when viewing Webhook policies	Medium EPSS 0.50%	`>= 2.5.0, < 2.5.2`	`2.5.2`
GHSA-jf8p-3vjh-pq94 Harbor fails to validate the user permissions when viewing Webhook policies	Medium EPSS 0.50%	`>= 2.0.0, < 2.4.3`	`2.4.3`
GHSA-3637-v6vq-xqqw Harbor fails to validate the user permissions when updating tag retention policies	High EPSS 0.55%	`>= 1.0.0, < 1.10.13`	`1.10.13`
GHSA-3637-v6vq-xqqw Harbor fails to validate the user permissions when updating tag retention policies	High EPSS 0.55%	`>= 2.0.0, < 2.4.3`	`2.4.3`
GHSA-3637-v6vq-xqqw Harbor fails to validate the user permissions when updating tag retention policies	High EPSS 0.55%	`>= 2.5.0, < 2.5.2`	`2.5.2`
GHSA-q76q-q8hw-hmpw Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs	High EPSS 0.53%	`>= 1.0.0, < 1.10.13`	`1.10.13`
GHSA-q76q-q8hw-hmpw Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs	High EPSS 0.53%	`>= 2.5.0, < 2.5.2`	`2.5.2`
GHSA-q76q-q8hw-hmpw Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs	High EPSS 0.53%	`>= 2.0.0, < 2.4.3`	`2.4.3`
GHSA-9wvh-ff5f-xjpj Missing Authorization in Harbor	Medium EPSS 22.44%	`>= 1.7.0, < 1.9.0-rc1`	`1.9.0-rc1`
GHSA-9wvh-ff5f-xjpj Missing Authorization in Harbor	Medium EPSS 22.44%	`>= 1.7.0, < 1.9.0-rc1`	`1.9.0-rc1`
GHSA-38r5-34mr-mvm7 "catalog's registry v2 api exposed on unauthenticated path in Harbor"	Medium EPSS 0.73%	`>= 2.1.0, < 2.1.2`	`2.1.2`
GHSA-38r5-34mr-mvm7 "catalog's registry v2 api exposed on unauthenticated path in Harbor"	Medium EPSS 0.73%	`< 2.0.5+incompatible` `>= 2.1.0+incompatible, < 2.1.2+incompatible`	`2.0.5+incompatible` `2.1.2+incompatible`
GHSA-38r5-34mr-mvm7 "catalog's registry v2 api exposed on unauthenticated path in Harbor"	Medium EPSS 0.73%	`< 2.0.5`	`2.0.5`
GHSA-q9x4-q76f-5h5j Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)	Medium EPSS 1.98%	`>= 1.7.0, < 1.10.3` `>= 2.0.0+incompatible, < 2.0.1+incompatible`	`1.10.3` `2.0.1+incompatible`
GHSA-q9x4-q76f-5h5j Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)	Medium EPSS 1.98%	`>= 2.0.0, < 2.0.1`	`2.0.1`
GHSA-q9x4-q76f-5h5j Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)	Medium EPSS 1.98%	`>= 1.7.0, < 1.10.3`	`1.10.3`
GHSA-33p6-fx42-7rf5 Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788)	Medium EPSS 1.30%	`>= 1.8.0, < 2.0.1`	`2.0.1`
GHSA-33p6-fx42-7rf5 Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788)	Medium EPSS 1.30%	`>= 1.8.0, < 2.0.1+incompatible`	`2.0.1+incompatible`
GHSA-q9p8-33wc-h432 Authenticated users can exploit an enumeration vulnerability in Harbor	Medium EPSS 1.27%	`< 2.0.3+incompatible`	`2.0.3+incompatible`
GHSA-q9p8-33wc-h432 Authenticated users can exploit an enumeration vulnerability in Harbor	Medium EPSS 1.27%	`< 2.0.3`	`2.0.3`
GHSA-rffr-c932-cpxv Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor	High EPSS 1.02%	`>= 1.7.0, < 1.8.6` `>= 1.9.0, < 1.9.3`	`1.8.6` `1.9.3`
GHSA-rffr-c932-cpxv Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor	High EPSS 1.02%	`>= 1.9.0, < 1.9.3`	`1.9.3`
GHSA-rffr-c932-cpxv Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor	High EPSS 1.02%	`>= 1.7.0, < 1.8.6`	`1.8.6`
GHSA-w4x5-jqq4-qc8x SQL Injection in Cloud Native Computing Foundation Harbor	Medium EPSS 1.42%	`>= 1.7.0, < 1.8.6` `>= 1.9.0, < 1.9.3`	`1.8.6` `1.9.3`
GHSA-w4x5-jqq4-qc8x SQL Injection in Cloud Native Computing Foundation Harbor	Medium EPSS 1.42%	`>= 1.7.0, < 1.8.6`	`1.8.6`
GHSA-w4x5-jqq4-qc8x SQL Injection in Cloud Native Computing Foundation Harbor	Medium EPSS 1.42%	`>= 1.9.0, < 1.9.3`	`1.9.3`
GHSA-jr34-mff8-pc6f SQL Injection in Cloud Native Computing Foundation Harbor	High EPSS 2.10%	`>= 1.7.0, < 1.8.6`	`1.8.6`
GHSA-jr34-mff8-pc6f SQL Injection in Cloud Native Computing Foundation Harbor	High EPSS 2.10%	`>= 1.9.0, < 1.9.3`	`1.9.3`
GHSA-jr34-mff8-pc6f SQL Injection in Cloud Native Computing Foundation Harbor	High EPSS 2.10%	`>= 1.7.0, < 1.8.6` `>= 1.9.0, < 1.9.3`	`1.8.6` `1.9.3`
GHSA-q6cj-6jvq-jwmh Privilege Escalation in Cloud Native Computing Foundation Harbor	Critical EPSS 1.62%	`>= 1.7.0, < 1.8.6` `>= 1.9.0, < 1.9.3`	`1.8.6` `1.9.3`
GHSA-q6cj-6jvq-jwmh Privilege Escalation in Cloud Native Computing Foundation Harbor	Critical EPSS 1.62%	`>= 1.9.0, < 1.9.3`	`1.9.3`
GHSA-q6cj-6jvq-jwmh Privilege Escalation in Cloud Native Computing Foundation Harbor	Critical EPSS 1.62%	`>= 1.7.0, < 1.8.6`	`1.8.6`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor