Vulnerability DatabaseCVE-2026-4404
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-4404
March 23, 2026
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
Related Resources (9)
%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345
https://www.kb.cert.org/vuls/id/577436
https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml
https://github.com/advisories/GHSA-hj7x-hmf2-hc2p
https://github.com/goharbor/harbor/pull/22751
https://cwe.mitre.org/data/definitions/1393.html
https://github.com/goharbor/harbor
https://nvd.nist.gov/vuln/detail/CVE-2026-4404
https://github.com/goharbor/harbor/issues/1937
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
9.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
LOW
Weakness Type (CWE)
Use of Hard-coded Credentials
CWE-798
Use of Default Password
CWE-1393
EPSS
Base Score:
0.04