CVE-2026-4404 - Vulnerability Details - OpenCVE

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://cwe.mitre.org/data/definitions/1393.html
https://github.com/goharbor/harbor/issues/1937
https://github.com/goharbor/harbor/pull/22751
https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345

History

Mon, 23 Mar 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1393 CWE-798
Metrics		cvssV3_1 `{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 23 Mar 2026 15:15:00 +0000

Type	Values Removed	Values Added
Description		Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
Title		Use of hard coded credentials in GoHarbor Harbor
References		https://cwe.mitre.org/data/definitions/1393.html https://github.com/goharbor/harbor/issues/1937 https://github.com/goharbor/harbor/pull/22751 https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2026-03-23T14:47:13.396Z

Updated: 2026-03-23T15:25:52.414Z

Reserved: 2026-03-18T19:43:57.063Z

Link: CVE-2026-4404

Vulnrichment

Updated: 2026-03-23T15:23:49.734Z

NVD

Status : Received

Published: 2026-03-23T15:16:35.403

Modified: 2026-03-23T16:16:50.840

Link: CVE-2026-4404

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4404", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-03-18T19:43:57.063Z", "datePublished": "2026-03-23T14:47:13.396Z", "dateUpdated": "2026-03-23T15:25:52.414Z"}, "containers": {"cna": {"title": "Use of hard coded credentials in GoHarbor Harbor", "descriptions": [{"lang": "en", "value": "Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Harbor", "product": "Harbor", "versions": [{"status": "affected", "version": "0.1.0", "lessThanOrEqual": "2.15.0", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "references": [{"url": "https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345"}, {"url": "https://github.com/goharbor/harbor/issues/1937"}, {"url": "https://cwe.mitre.org/data/definitions/1393.html"}, {"url": "https://github.com/goharbor/harbor/pull/22751"}], "x_generator": {"engine": "VINCE 3.0.34", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-4404"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-03-23T14:47:13.396Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-798", "lang": "en", "description": "CWE-798 Use of Hard-coded Credentials"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-1393", "lang": "en", "description": "CWE-1393 Use of Default Password"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:24:29.261835Z", "id": "CVE-2026-4404", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:25:52.414Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-4404", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:24:29.261835Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1393", "description": "CWE-1393 Use of Default Password"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:23:49.734Z"}}], "cna": {"title": "Use of hard coded credentials in GoHarbor Harbor", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Harbor", "product": "Harbor", "versions": [{"status": "affected", "version": "0.1.0", "versionType": "custom", "lessThanOrEqual": "2.15.0"}]}], "references": [{"url": "https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345"}, {"url": "https://github.com/goharbor/harbor/issues/1937"}, {"url": "https://cwe.mitre.org/data/definitions/1393.html"}, {"url": "https://github.com/goharbor/harbor/pull/22751"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.34", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-4404"}, "descriptions": [{"lang": "en", "value": "Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-03-23T14:47:13.396Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4404", "state": "PUBLISHED", "dateUpdated": "2026-03-23T15:25:52.414Z", "dateReserved": "2026-03-18T19:43:57.063Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-03-23T14:47:13.396Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}