Ddos 
The CERT Coordination Center (CERT/CC) has issued a critical security warning regarding GoHarbor’s Harbor, a widely used open-source container registry. The vulnerability, tracked as CVE-2026-4404 with a CVSS score of 9.4, centers on a risky default credential policy that could leave entire cloud-native environments open to total compromise.
Harbor is essential for many organizations to store, sign, and manage container images, but a simple oversight in its setup process has created what researchers call a “significant security risk”.
The flaw stems from how Harbor initializes its administrative access. By default, the system creates an account with the username admin and the password Harbor12345. While it is standard practice for administrators to change these during setup, the platform does not force this action.
As the advisory warns: “Harbor does not enforce a password change during setup or upon first login. If the default credentials remain unchanged, a remote attacker can authenticate using the publicly known password to gain full administrative access”.
Because Harbor sits at the heart of the development lifecycle, the impact of an administrative breach is catastrophic. An attacker with these privileges can “fully compromise the Harbor registry and all managed artifacts”.
The most severe risk involves supply chain attacks. By gaining access, a malicious actor could overwrite legitimate container images with poisoned versions. These tainted images are then pulled into Kubernetes environments or CI/CD pipelines, potentially leading to remote code execution (RCE) across an organization’s entire infrastructure.
Beyond image injection, the advisory notes several other critical risks:
- Persistent Access: Attackers can create new robot accounts or API tokens to maintain a “backdoor” even if the original password is eventually changed.
- Data Exfiltration: Sensitive or proprietary images can be stolen by configuring replication to external, attacker-controlled registries.
- Security Sabotage: Attackers can disable signature enforcement and vulnerability scanning, making the registry a “blind spot” for other security tools.
To mitigate this threat, operators must move away from default settings immediately. CERT/CC recommends that the harbor_admin_password parameter in the harbor.yml configuration file be changed to a unique, strong value either before or immediately after deployment.
The Harbor project has already proposed a permanent fix to “address the hardcoded default password by removing or randomizing default credentials during installation”. Users are encouraged to update to the latest patched versions (Harbor 2.15.0 and later) to ensure these security enforcements are in place.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
