PT-2026-29917 · Go · Github.Com/Goharbor/Harbor

Published 2026-03-26 · Updated 2026-03-26

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Impact

Harbor write configuration payload to audit log when configuration change, the ldap search password and oidc client secret will be logged in the audit log without redacted

Patches

Harbor v2.15.0, v2.14.3, v2.13.5

Workarounds

Disable audit log configure event in Harbor Web Console: Go to Administration -> Configuration -> Enable Audit Log Event Type -> Uncheck "Update Configuration" and click "Save" Button.

Fix

Cleartext Storage of Sensitive Information

Insertion into Log File

Weakness Enumeration

CWE-312

CWE-532

Related Identifiers

GHSA-PRH4-VHFH-24MJ

Affected Products

Github.Com/Goharbor/Harbor

References · 4

• https://osv.dev/vulnerability/GHSA-prh4-vhfh-24mj · Vendor Advisory
• https://github.com/goharbor/harbor/commit/85e756486fc19333c5c300d7ac273e1580dc9350 · Note
• https://github.com/goharbor/harbor/security/advisories/GHSA-prh4-vhfh-24mj · Note
• https://github.com/goharbor/harbor · Note