What’s Vulnerable › Products

Harbor vulnerabilities

24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your Harbor version is affected

Latest Harbor vulnerabilities

• CVE-2026-111590 — SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services
• CVE-2026-4404 — Use of hard coded credentials in GoHarbor Harbor (CVSS 9.4)
• CVE-2022-31671 — Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs (CVSS 7.4)
• CVE-2022-31670 — Harbor fails to validate the user permissions when updating tag retention policies (CVSS 7.7)
• CVE-2022-31669 — Harbor fails to validate the user permissions when updating tag immutability policies (CVSS 7.7)
• CVE-2022-31668 — User permission validation failure and disclosure of P2P preheat execution logs (CVSS 7.7)
• CVE-2022-31667 — Harbor fails to validate the user permissions when updating a robot account (CVSS 6.4)
• CVE-2022-31666 — Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies (CVSS 5.4)
• CVE-2024-22278 — Harbor fails to validate the user permissions when updating project configurations (CVSS 4.3)
• CVE-2024-22261 — SQL Injection in Harbor scan log API (CVSS 5.5)
• CVE-2024-22244 — Harbor Open Redirect URL (CVSS 6.1)
• CVE-2023-20902 — Timing attack risk in Harbor (CVSS 6.5)
• CVE-2022-46463 — (CVSS 7.5)
• CVE-2019-19030 — (CVSS 5.3)
• CVE-2020-29662 — (CVSS 5.3)
• CVE-2020-13794 — (CVSS 4.3)
• CVE-2020-13788 — (CVSS 4.3)
• CVE-2019-19029 — (CVSS 7.2)
• CVE-2019-19026 — (CVSS 4.9)
• CVE-2019-19025 — (CVSS 8.8)
• CVE-2019-19023 — (CVSS 8.8)
• CVE-2019-3990 — (CVSS 4.3)
• CVE-2019-16919 — (CVSS 7.5)
• CVE-2019-16097 — (CVSS 6.5)
• CVE-2017-17697 — (CVSS 8.6)