What’s Vulnerable › Vulnerabilities

CVE-2019-16919

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-10-18 · updated 2026-06-17
• Weakness: CWE-276

Description

Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account.

Affected products

• Harbor: from 1.8.0 through 1.8.3; 1.9.0
• VMware Cloud Foundation: all versions
• VMware Harbor Container Registry: from 1.7.0 through 1.7.6; from 1.8.0 before 1.8.4 — fixed in 1.8.4

How to fix

Upgrade to a fixed version: VMware Harbor Container Registry 1.8.4. Check the vendor advisory for mitigations.

References

• http://www.vmware.com/security/advisories/VMSA-2019-0016.html
• https://github.com/goharbor/harbor/security/advisories/GHSA-x2r2-w9c7-h624
• https://landscape.cncf.io/selected=harbor
• http://www.vmware.com/security/advisories/VMSA-2019-0016.html
• https://github.com/goharbor/harbor/security/advisories/GHSA-x2r2-w9c7-h624
• https://landscape.cncf.io/selected=harbor

Get alerted when CVE-2019-16919 or the next vulnerability affects your stack