# github.com/goharbor/harbor (Go) vulnerabilities 22 known vulnerabilities (1 critical, 4 high, 8 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v2.15.4+incompatible (Oct 9, 2026): affected by 2 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 500+ since v2.12.3+incompatible (Apr 29, 2025) - Registry: https://pkg.go.dev/github.com/goharbor/harbor - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-4404: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.15.4+incompatible (through the newest release) - CVE-2025-30086: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.12.4-rc1+incompatible (v2.12.4+incompatible is outside it); v2.13.0+incompatible to v2.13.1-rc3+incompatible (v2.13.1+incompatible is outside it) - CVE-2025-32019: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.15.4+incompatible (through the newest release) - CVE-2022-31668: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it) - CVE-2022-31667: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it) - CVE-2022-31669: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it) - CVE-2022-31670: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it) - CVE-2022-31671: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it) - CVE-2022-31666: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it) - CVE-2024-22278: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it) - CVE-2024-22261: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it) - CVE-2024-22244: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it) - CVE-2023-20902: v2.4.0-rc1.0.20250402095018-68eea5f3fda6+incompatible to v2.4.0-rc1.0.20261014105100-5bdb8a678fa1+incompatible (v2.12.3-rc1+incompatible is outside it) - CVE-2019-19030: no published release is affected - CVE-2020-29662: no published release is affected - CVE-2020-13794: no published release is affected - CVE-2020-13788: no published release is affected - CVE-2019-19023: no published release is affected - CVE-2019-19029: no published release is affected - CVE-2019-19026: no published release is affected - CVE-2019-19025: no published release is affected - CVE-2019-16097: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (22) ### [CVE-2026-4404](https://cve.now/CVE-2026-4404): Use of hard coded credentials in GoHarbor Harbor - Severity: Critical 9.4 - Published: Mar 23, 2026 - Affected: through 2.15.0; all versions. - No fix released. The latest release, v2.15.4+incompatible, is still affected. ### [CVE-2025-30086](https://cve.now/CVE-2025-30086): CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak… - Severity: Medium 4.9 - Published: Jul 25, 2025 - Affected: fixed in 2.12.4+incompatible; from 2.13.0+incompatible, fixed in 2.13.1+incompatible; from 2.13.0, fixed in 2.13.1; from 2.4.0-rc1.1, fixed in 2.12.4; fixed in 2.4.0-rc1.0.20250331071157-dce7d9f5cffb. - Fixed in v2.12.4+incompatible (released May 22, 2025, 64 days before disclosure) and v2.13.1+incompatible (released May 20, 2025, 66 days before disclosure). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2025-32019](https://cve.now/CVE-2025-32019): Harbor's repository description page allows for XSS - Severity: Medium 4.1 - Published: Jul 23, 2025 - Affected: all versions; from 2.12.0-rc1+incompatible, fixed in 2.12.4-rc1+incompatible; from 2.13.0-rc1+incompatible, fixed in 2.13.1-rc1+incompatible; from 2.12.0-rc1, fixed in 2.12.4-rc1; from 2.13.0-rc1, fixed in 2.13.1-rc1; from 2.4.0-rc1.1, through 2.11.2; fixed in 2.4.0-rc1.0.20250421072404-a13a16383a41. - No fix released. The latest release, v2.15.4+incompatible, is still affected. ### [CVE-2022-31668](https://cve.now/CVE-2022-31668): User permission validation failure and disclosure of P2P preheat execution logs - Severity: High 7.4 - Published: Nov 14, 2024 - Affected: from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2; from 2.0.0+incompatible, fixed in 2.4.3+incompatible; from 2.5.0+incompatible, fixed in 2.5.2+incompatible. - Fixed in v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2022-31667](https://cve.now/CVE-2022-31667): Harbor fails to validate the user permissions when updating a robot account - Severity: Medium 6.4 - Published: Nov 14, 2024 - Affected: from 1.0.0, fixed in 1.10.13; from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2. - Fixed in 1.10.13 and v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2022-31669](https://cve.now/CVE-2022-31669): Harbor fails to validate the user permissions when updating tag immutability policies - Severity: Medium 6.4 - Published: Nov 14, 2024 - Affected: from 1.0.0, fixed in 1.10.13; from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2. - Fixed in 1.10.13 and v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2022-31670](https://cve.now/CVE-2022-31670): Harbor fails to validate the user permissions when updating tag retention policies - Severity: High 7.7 - Published: Nov 14, 2024 - Affected: from 1.0.0, fixed in 1.10.13; from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2. - Fixed in 1.10.13 and v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2022-31671](https://cve.now/CVE-2022-31671): Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs - Severity: High 7.4 - Published: Nov 14, 2024 - Affected: from 1.0.0, fixed in 1.10.13; from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2. - Fixed in 1.10.13 and v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2022-31666](https://cve.now/CVE-2022-31666): Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies - Severity: High 7.7 - Published: Nov 14, 2024 - Affected: from 1.0.0, fixed in 1.10.13; from 2.0.0, fixed in 2.4.3; from 2.5.0, fixed in 2.5.2. - Fixed in 1.10.13 and v2.12.3+incompatible (released Apr 29, 2025, 166 days after disclosure, the advisory names 2.4.3, which was never published). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2024-22278](https://cve.now/CVE-2024-22278): Harbor fails to validate the user permissions when updating project configurations - Severity: Medium 6.4 - Published: Aug 2, 2024 - Affected: fixed in 2.9.5; from 2.10.0, fixed in 2.10.3; fixed in 2.9.5+incompatible; from 2.10.0+incompatible, fixed in 2.10.3+incompatible. - Fixed in v2.12.3+incompatible (released Apr 29, 2025, 270 days after disclosure, the advisory names 2.9.5, which was never published). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2024-22261](https://cve.now/CVE-2024-22261): SQL Injection in Harbor scan log API - Severity: Low 2.7 - Published: Jun 10, 2024 - Affected: fixed in 2.8.6; from 2.9.0, fixed in 2.9.4; from 2.10.0, fixed in 2.10.2; fixed in 2.8.6+incompatible; from 2.9.0+incompatible, fixed in 2.9.4+incompatible; from 2.10.0+incompatible, fixed in 2.10.2+incompatible. - Fixed in v2.12.3+incompatible (released Apr 29, 2025, 323 days after disclosure, the advisory names 2.8.6, which was never published). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2024-22244](https://cve.now/CVE-2024-22244): Harbor Open Redirect URL - Severity: Medium 4.3 - Published: Jun 10, 2024 - Affected: fixed in 2.8.5+incompatible; from 2.9.0+incompatible, fixed in 2.9.3+incompatible; from 2.10.0+incompatible, fixed in 2.10.1+incompatible; fixed in 2.8.5; from 2.9.0, fixed in 2.9.3; from 2.10.0, fixed in 2.10.1. - Fixed in v2.12.3+incompatible (released Apr 29, 2025, 323 days after disclosure, the advisory names 2.8.5+incompatible, which was never published). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2023-20902](https://cve.now/CVE-2023-20902): Timing attack risk in Harbor - Severity: Medium 5.9 - Published: Nov 9, 2023 - Affected: fixed in 1.10.18; from 2.0.0+incompatible, fixed in 2.7.3+incompatible; from 2.8.0+incompatible, fixed in 2.8.3+incompatible; fixed in 1.10.18; from 2.0.0, fixed in 2.7.3; from 2.8.0, fixed in 2.8.3. - Fixed in 1.10.18 and v2.12.3+incompatible (released Apr 29, 2025, 537 days after disclosure, the advisory names 2.7.3+incompatible, which was never published). - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2019-19030](https://cve.now/CVE-2019-19030): Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls… - Severity: Medium 5.3 - Published: Dec 26, 2022 - Affected: from 1.7.0, fixed in 1.10.3; from 2.0.0, fixed in 2.0.1; from 1.7.0, fixed in 1.10.3; from 2.0.0+incompatible, fixed in 2.0.1+incompatible. - Fixed in 1.10.3, 2.0.1 and 2.0.1+incompatible. - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2020-29662](https://cve.now/CVE-2020-29662): In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path. - Severity: Unrated - Published: Feb 2, 2021 - Affected: fixed in 2.0.5; from 2.1.0, fixed in 2.1.2; fixed in 2.0.5+incompatible; from 2.1.0+incompatible, fixed in 2.1.2+incompatible. - Fixed in 2.0.5, 2.0.5+incompatible, 2.1.2 and 1 other version. - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2020-13794](https://cve.now/CVE-2020-13794): Harbor 1.9. 1.10. and 2.0. allows Exposure of Sensitive Information to an Unauthorized Actor. - Severity: Unrated - Published: Sep 29, 2020 - Affected: fixed in 2.0.3+incompatible; fixed in 2.0.3. - Fixed in 2.0.3+incompatible and 2.0.3. - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2020-13788](https://cve.now/CVE-2020-13788): Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible… - Severity: Unrated - Published: Jul 15, 2020 - Affected: from 1.8.0, fixed in 2.0.1; from 1.8.0, fixed in 2.0.1+incompatible. - Fixed in 2.0.1 and 2.0.1+incompatible. - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2019-19023](https://cve.now/CVE-2019-19023): Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container… - Severity: Unrated - Published: Mar 20, 2020 - Affected: from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3; from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3. - Fixed in 1.8.6 and 1.9.3. - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2019-19029](https://cve.now/CVE-2019-19029): Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container… - Severity: Unrated - Published: Mar 20, 2020 - Affected: from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3; from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3. - Fixed in 1.8.6 and 1.9.3. - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2019-19026](https://cve.now/CVE-2019-19026): Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container… - Severity: Unrated - Published: Mar 20, 2020 - Affected: from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3; from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3. - Fixed in 1.8.6 and 1.9.3. - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2019-19025](https://cve.now/CVE-2019-19025): Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal… - Severity: Unrated - Published: Mar 20, 2020 - Affected: from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3; from 1.7.0, fixed in 1.8.6; from 1.9.0, fixed in 1.9.3. - Fixed in 1.8.6 and 1.9.3. - The latest release, v2.15.4+incompatible, is not affected. ### [CVE-2019-16097](https://cve.now/CVE-2019-16097): core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is… - Severity: Unrated - Published: Sep 8, 2019 - Affected: from 1.7.0, fixed in 1.9.0-rc1. - Fixed in 1.9.0-rc1. - The latest release, v2.15.4+incompatible, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/goharbor/harbor Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.