Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/goharbor/harbor

22 known vulnerabilities (1 critical, 4 high, 8 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
v2.15.4+incompatible (Oct 9, 2026): affected by 2 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
22 · 1 critical, 4 high, 8 medium, 1 low
Releases
500+ since v2.12.3+incompatible (Apr 29, 2025)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-4404
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.15.4+incompatible (through the newest release)
  • CVE-2025-30086
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.12.4-rc1+incompatible (v2.12.4+incompatible is outside it); v2.13.0+incompatible to v2.13.1-rc3+incompatible (v2.13.1+incompatible is outside it)
  • CVE-2025-32019
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.15.4+incompatible (through the newest release)
  • CVE-2022-31668
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it)
  • CVE-2022-31667
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it)
  • CVE-2022-31669
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it)
  • CVE-2022-31670
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it)
  • CVE-2022-31671
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it)
  • CVE-2022-31666
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it)
  • CVE-2024-22278
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it)
  • CVE-2024-22261
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it)
  • CVE-2024-22244
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it)
Show all 22 advisoriesShow fewer advisories
  • CVE-2023-20902
    Affects v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it)
  • CVE-2019-19030
    No published release is affected
    No published release is affected
  • CVE-2020-29662
    No published release is affected
    No published release is affected
  • CVE-2020-13794
    No published release is affected
    No published release is affected
  • CVE-2020-13788
    No published release is affected
    No published release is affected
  • CVE-2019-19023
    No published release is affected
    No published release is affected
  • CVE-2019-19029
    No published release is affected
    No published release is affected
  • CVE-2019-19026
    No published release is affected
    No published release is affected
  • CVE-2019-19025
    No published release is affected
    No published release is affected
  • CVE-2019-16097
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 22

  • CVE-2026-4404Critical 9.4

    Use of hard coded credentials in GoHarbor Harbor

    Affected: through 2.15.0; all versions.

    No fix released. The latest release, v2.15.4+incompatible, is still affected.

  • CVE-2025-30086Medium 4.9

    CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak…

    Affected: fixed in 2.12.4+incompatible; from 2.13.0+incompatible, fixed in 2.13.1+incompatible; from 2.13.0, fixed in 2.13.1; from 2.4.0-rc1.1, fixed in 2.12.4; fixed in 2.4.0-rc1.0.20250331071157-dce7d9f5cffb.

    Fixed in v2.12.4+incompatible (released May 22, 2025, 64 days before disclosure) and v2.13.1+incompatible (released May 20, 2025, 66 days before disclosure).

    The latest release, v2.15.4+incompatible, is not affected.

  • CVE-2025-32019Medium 4.1

    Harbor's repository description page allows for XSS

    Affected: all versions; from 2.12.0-rc1+incompatible, fixed in 2.12.4-rc1+incompatible; from 2.13.0-rc1+incompatible, fixed in 2.13.1-rc1+incompatible; from 2.12.0-rc1, fixed in 2.12.4-rc1; from 2.13.0-rc1, fixed in 2.13.1-rc1; from 2.4.0-rc1.1, through 2.11.2; fixed in 2.4.0-rc1.0.20250421072404-a13a16383a41.

    No fix released. The latest release, v2.15.4+incompatible, is still affected.

  • User permission validation failure and disclosure of P2P preheat execution logs

    Affected: from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2; from 2.0.0+incompatible, fixed in 2.4.3+incompatible; from 2.5.0+incompatible, fixed in 2.5.2+incompatible.

    Fixed in v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published).

    The latest release, v2.15.4+incompatible, is not affected.

  • CVE-2022-31667Medium 6.4

    Harbor fails to validate the user permissions when updating a robot account

    Affected: from 1.0.0, fixed in 1.10.13; from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2.

    Fixed in 1.10.13 and v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published).

    The latest release, v2.15.4+incompatible, is not affected.

  • CVE-2022-31669Medium 6.4

    Harbor fails to validate the user permissions when updating tag immutability policies

    Affected: from 1.0.0, fixed in 1.10.13; from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2.

    Fixed in 1.10.13 and v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published).

    The latest release, v2.15.4+incompatible, is not affected.

  • Harbor fails to validate the user permissions when updating tag retention policies

    Affected: from 1.0.0, fixed in 1.10.13; from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2.

    Fixed in 1.10.13 and v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published).

    The latest release, v2.15.4+incompatible, is not affected.

  • Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs

    Affected: from 1.0.0, fixed in 1.10.13; from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2.

    Fixed in 1.10.13 and v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published).

    The latest release, v2.15.4+incompatible, is not affected.

  • Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies

    Affected: from 1.0.0, fixed in 1.10.13; from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2.

    Fixed in 1.10.13 and v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published).

    The latest release, v2.15.4+incompatible, is not affected.

  • CVE-2024-22278Medium 6.4

    Harbor fails to validate the user permissions when updating project configurations

    Affected: fixed in 2.9.5; from 2.10.0, fixed in 2.10.3; fixed in 2.9.5+incompatible; from 2.10.0+incompatible, fixed in 2.10.3+incompatible.

    Fixed in v2.12.3+incompatible (released Apr 29, 2025, 270 days after disclosure, the advisory names 2.9.5, which was never published).

    The latest release, v2.15.4+incompatible, is not affected.

  • SQL Injection in Harbor scan log API

    Affected: fixed in 2.8.6; from 2.9.0, fixed in 2.9.4; from 2.10.0, fixed in 2.10.2; fixed in 2.8.6+incompatible; from 2.9.0+incompatible, fixed in 2.9.4+incompatible; from 2.10.0+incompatible, fixed in 2.10.2+incompatible.

    Fixed in v2.12.3+incompatible (released Apr 29, 2025, 323 days after disclosure, the advisory names 2.8.6, which was never published).

    The latest release, v2.15.4+incompatible, is not affected.

  • CVE-2024-22244Medium 4.3

    Harbor Open Redirect URL

    Affected: fixed in 2.8.5+incompatible; from 2.9.0+incompatible, fixed in 2.9.3+incompatible; from 2.10.0+incompatible, fixed in 2.10.1+incompatible; fixed in 2.8.5; from 2.9.0, fixed in 2.9.3; from 2.10.0, fixed in 2.10.1.

    Fixed in v2.12.3+incompatible (released Apr 29, 2025, 323 days after disclosure, the advisory names 2.8.5+incompatible, which was never published).

    The latest release, v2.15.4+incompatible, is not affected.

  • CVE-2023-20902Medium 5.9

    Timing attack risk in Harbor

    Affected: fixed in 1.10.18; from 2.0.0+incompatible, fixed in 2.7.3+incompatible; from 2.8.0+incompatible, fixed in 2.8.3+incompatible; fixed in 1.10.18; from 2.0.0, fixed in 2.7.3; from 2.8.0, fixed in 2.8.3.

    Fixed in 1.10.18 and v2.12.3+incompatible (released Apr 29, 2025, 537 days after disclosure, the advisory names 2.7.3+incompatible, which was never published).

    The latest release, v2.15.4+incompatible, is not affected.

  • CVE-2019-19030Medium 5.3

    Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls…

    Affected: from 1.7.0, fixed in 1.10.3; from 2.0.0, fixed in 2.0.1; from 1.7.0, fixed in 1.10.3; from 2.0.0+incompatible, fixed in 2.0.1+incompatible.

    Fixed in 1.10.3, 2.0.1 and 2.0.1+incompatible.

    The latest release, v2.15.4+incompatible, is not affected.

  • In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.

    Affected: fixed in 2.0.5; from 2.1.0, fixed in 2.1.2; fixed in 2.0.5+incompatible; from 2.1.0+incompatible, fixed in 2.1.2+incompatible.

    Fixed in 2.0.5, 2.0.5+incompatible, 2.1.2 and 1 other version.

    The latest release, v2.15.4+incompatible, is not affected.

Show all 22 advisoriesShow fewer advisories

  • Harbor 1.9. 1.10. and 2.0. allows Exposure of Sensitive Information to an Unauthorized Actor.

    Affected: fixed in 2.0.3+incompatible; fixed in 2.0.3.

    Fixed in 2.0.3+incompatible and 2.0.3.

    The latest release, v2.15.4+incompatible, is not affected.

  • Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible…

    Affected: from 1.8.0, fixed in 2.0.1; from 1.8.0, fixed in 2.0.1+incompatible.

    Fixed in 2.0.1 and 2.0.1+incompatible.

    The latest release, v2.15.4+incompatible, is not affected.

  • Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container…

    Affected: from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3; from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3.

    Fixed in 1.8.6 and 1.9.3.

    The latest release, v2.15.4+incompatible, is not affected.

  • Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container…

    Affected: from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3; from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3.

    Fixed in 1.8.6 and 1.9.3.

    The latest release, v2.15.4+incompatible, is not affected.

  • Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container…

    Affected: from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3; from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3.

    Fixed in 1.8.6 and 1.9.3.

    The latest release, v2.15.4+incompatible, is not affected.

  • Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal…

    Affected: from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3; from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3.

    Fixed in 1.8.6 and 1.9.3.

    The latest release, v2.15.4+incompatible, is not affected.

  • core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is…

    Affected: from 1.7.0, fixed in 1.9.0-rc1.

    Fixed in 1.9.0-rc1.

    The latest release, v2.15.4+incompatible, is not affected.