PT-2026-27137 · Goharbor · Goharbor

Notnotnotveg · Publicado 2026-03-23 · Atualizado 2026-03-27 · CVE-2026-4404

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions GoHarbor versions prior to 2.15.0

Description The use of hard-coded credentials in GoHarbor allows attackers to use the default password and gain access to the web user interface.

Recommendations Update GoHarbor to version 2.15.0 or later.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-1393

Identificadores relacionados

CVE-2026-4404

GHSA-HJ7X-HMF2-HC2P

GO-2026-4845

SUSE-SU-2026:1135-1

Produtos afetados

Goharbor

Referências · 157

• https://github.com/goharbor/harbor · Nota
• https://github.com/goharbor/harbor/pull/22751 · Nota
• https://github.com/goharbor/harbor/issues/1937 · Nota
• https://suse.com/security/cve/CVE-2026-32750 · Nota
• https://suse.com/security/cve/CVE-2026-33678 · Nota
• https://suse.com/security/cve/CVE-2026-33525 · Nota
• https://suse.com/security/cve/CVE-2026-2578 · Nota
• https://suse.com/security/cve/CVE-2026-32301 · Nota
• https://twitter.com/CCBalert/status/2036817648449630226 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-32694 · Nota
• https://suse.com/security/cve/CVE-2026-32828 · Nota
• https://suse.com/security/cve/CVE-2026-33528 · Nota
• https://suse.com/security/cve/CVE-2026-33067 · Nota
• https://suse.com/security/cve/CVE-2026-33252 · Nota
• https://suse.com/security/cve/CVE-2026-32287 · Nota