PT-2026-27137 · Goharbor · Goharbor

Notnotnotveg · Published 2026-03-23 · Updated 2026-03-27 · CVE-2026-4404

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions GoHarbor versions prior to 2.15.0

Description The use of hard-coded credentials in GoHarbor allows attackers to use the default password and gain access to the web user interface.

Recommendations Update GoHarbor to version 2.15.0 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-1393

Related Identifiers

CVE-2026-4404

GHSA-HJ7X-HMF2-HC2P

GO-2026-4845

SUSE-SU-2026:1135-1

Affected Products

Goharbor

References · 157

• https://nvd.nist.gov/vuln/detail/CVE-2026-4404 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4845 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hj7x-hmf2-hc2p · Vendor Advisory
• https://github.com/goharbor/harbor · Note
• https://github.com/goharbor/harbor/pull/22751 · Note
• https://github.com/goharbor/harbor/issues/1937 · Note
• https://suse.com/security/cve/CVE-2026-32750 · Note
• https://suse.com/security/cve/CVE-2026-33678 · Note
• https://suse.com/security/cve/CVE-2026-33525 · Note
• https://suse.com/security/cve/CVE-2026-2578 · Note
• https://suse.com/security/cve/CVE-2026-32301 · Note
• https://twitter.com/CCBalert/status/2036817648449630226 · Twitter Post
• https://suse.com/security/cve/CVE-2026-32694 · Note
• https://suse.com/security/cve/CVE-2026-32828 · Note