External risk intelligence

Hardcoded Credentials in GoHarbor Allow Unauthorized Web UI Access.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-4404

Harbor is a container image registry typically deployed as a network-accessible service to manage images across environments. As a web-based repository often integrated into CI/CD pipelines, its UI and API endpoints are frequently exposed to the network, making internet or intranet reachability a standard deployment pattern.

Linuxfoundation Harbor

2.15.0 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Harbor software, specifically related to hardcoded default credentials. This flaw allows unauthorized individuals to access the web interface using well-known default credentials, potentially compromising the integrity and confidentiality of container images and related data. The main concern is confirming the relevance and exposure of this vulnerability to our systems.

Default passwords grant web access.
Important for supply chain and image security.
Verify system relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by accessing the web UI of Harbor over the network. Since hardcoded credentials are used, an attacker does not need legitimate credentials to log in. Successfully logging in allows the attacker to gain access to the web UI.

No authentication required to access.
Default password grants access.
Unauthorized access to web UI.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, hardcoded credentials in GoHarbor Harbor could allow unauthenticated attackers to access the web UI with administrative privileges. This could expose system data and alter service behavior.

System and user data at risk.
Attackers gain unauthorized UI access.
Potential for data modification or deletion.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical nature of hardcoded credentials in GoHarbor necessitates immediate action from teams responsible for application security and infrastructure management. The first practical step is to identify all instances of GoHarbor, assess their exposure and business criticality, and confirm the accountable owner for each. Following this, a remediation plan should be developed based on the identified risk level.

Application and infrastructure teams own this issue.
Verify GoHarbor instances and their reachability.
Plan risk-based remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GoHarbor Harbor?

Harbor is an open-source container image registry hosted by the Linux Foundation. Organizations use it to store, sign, and scan container images, serving as a critical central hub for managing software supply chains and distributing images to deployment environments.

How does CWE-798 relate to CVE-2026-4404?

CVE-2026-4404 involves the use of hard-coded credentials, categorized as CWE-798. This weakness means the software contains an embedded, static password. In this case, Harbor relies on a default administrative password that is known publicly, allowing anyone to bypass login security and gain unauthorized control over the web interface.

Do I need special access to trigger CVE-2026-4404?

No. An attacker does not need prior authentication or special privileges to exploit this vulnerability. Simply navigating to the web UI and entering the default credentials is sufficient. This bug is not triggered by internal code errors but by the existence of the default account itself, which remains active if not manually changed.

Is my Harbor instance at risk?

If your instance is reachable via a network, Halo Surface Signal identifies it as a likely target. Because Harbor is typically deployed as a network-accessible service to integrate with CI/CD pipelines, it is frequently exposed to broader network segments, increasing the likelihood that an unauthorized user could reach the vulnerable web login page.

When should I prioritize fixing this?

Given the critical severity, you should prioritize this immediately. Begin by locating all active Harbor deployments and verifying their current configuration. Since the vulnerability stems from default credentials, the primary defensive step is to change any default passwords immediately, then consult the official vendor documentation for permanent security hardening steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.