CVE-2026-4404

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-4404
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4404.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-4404
Aliases
Downstream
Related
Published
2026-03-23T14:47:13.396Z
Modified
2026-08-17T08:10:45.372296879Z
Severity
  • 9.4 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
Use of hard coded credentials in GoHarbor Harbor
Details

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

Database specific 
{
    "cna_assigner": "certcc",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4404.json"
}
References

Affected packages

Git / github.com/goharbor/harbor

Affected ranges

Type
GIT
Repo
https://github.com/goharbor/harbor
Events
Introduced
e39dfd48acb47b0e2806ee687eafca73753df49d
Last affected
e2b5ce92728f86c4b02f6a9a667741c1e5b62678
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "last_affected": "2.15.0"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*"
}

Affected versions

0.*
0.1.0
0.1.1
0.3.0
0.3.5
0.3.5-rc
0.4.0
0.4.1
0.4.5
0.5.0
0.5.0-rc1
0.5.0-rc2
1.*
1.1.0-rc1
1.1.0-rc2
v1.*
v1.1.0
v1.1.0-rc3
v1.10.0-rc1
v1.2.0-rc1
v1.2.0-rc2
v1.2.0-rc3
v1.2.0-rc4
v1.3.0-rc1
v1.4.0-rc1
v1.4.0-rc2
v1.7.0-rc1
v2.*
v2.0.0-rc1
v2.1.0-rc1
v2.1.0-tech-preview
v2.1.0-tech-prview
v2.15.0
v2.15.0-rc1
v2.15.0-rc2
v2.15.0-rc3
v2.15.0-rc4
v2.2.0-rc1
v2.3.0-rc1
v2.3.0.-rc1
v2.4.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4404.json"