CVE-2026-4404

The Harbor application has hardcoded default administrator credentials (login: admin, password: Harbor12345), which are set at factory defaults and are not enforced to be changed during installation. An attacker can use these publicly known credentials to log in to the web administration panel. The vulnerability is classified as CWE-798 (use of hardcoded credentials) and CWE-1393 (use of default passwords), meaning the problem lies in the application design rather than a logic error.

An attacker gains full administrative access to the Harbor web interface, which may lead to takeover of the container image repository, disclosure of sensitive data, and manipulation of stored artifacts.

The default administrator password (Harbor12345) must be changed immediately to a strong, unique password. It is recommended to update to the version of Harbor in which the issue was resolved according to the pull request indicated in the references (github.com/goharbor/harbor/pull/22751). Additionally, verify that no production environments are running with default credentials and restrict access to the administration panel at the network level (firewall, VPN).

GoHarbor Harbor version 2.15.0 and all earlier versions in which the default administrator password has not been changed after installation.