Is github.com/goharbor/harbor safe ? github.com/goharbor/harbor (go) has 23 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 5 direct dependencies
3 carry known advisories, worst HIGH
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 44th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-hj7x-hmf2-hc2p, the advisory selected below
// 23 advisories GHSA-hj7x-hmf2-hc2p Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI. CRIT GHSA-r864-28pw-8682 Harbor fails to validate the user permissions when updating p2p preheat policies. HIGH GHSA-hw28-333w-qxp3 Harbor fails to validate the maintainer role permissions when creating/updating/deleting project configurations - API call: HIGH GHSA-3637-v6vq-xqqw Harbor fails to validate the user permissions when updating tag retention policies. HIGH GHSA-jf8p-3vjh-pq94 Harbor fails to validate the user permissions to view Webhook policies including relevant credentials configured in different projects the user doesn’t have… HIGH GHSA-jr34-mff8-pc6f Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal… HIGH GHSA-rffr-c932-cpxv Cure53 has discovered that the Harbor web interface does not implement protection mechanisms against Cross-Site Request Forgery (CSRF). HIGH GHSA-prh4-vhfh-24mj Harbor write configuration payload to audit log when configuration change, the ldapsearchpassword and oidcclientsecret will be logged in the audit log without… MODE GHSA-h27m-3qw8-3pw8 Administrator users on Harbor could exploit an ORM Leak (https://www.elttam.com/blog/plormbing-your-django-orm/) vulnerability that was present in the… MODE GHSA-f9vc-vf3r-pqqq In the Harbor repository information, it is possible to inject code resulting in a stored XSS issue. MODE Show all 23 advisories Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability Low // questions Is github.com/goharbor/harbor safe to install? CyberXYZ does not call a package safe in absolute terms. It records 23 known vulnerabilities for github.com/goharbor/harbor (go), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/goharbor/harbor have known vulnerabilities? Yes. CyberXYZ records 23 known vulnerabilities for github.com/goharbor/harbor (go), the worst rated CRITICAL. These include GHSA-hj7x-hmf2-hc2p, GHSA-r864-28pw-8682, GHSA-hw28-333w-qxp3, GHSA-3637-v6vq-xqqw, GHSA-jf8p-3vjh-pq94.
How do I check github.com/goharbor/harbor before installing? Search github.com/goharbor/harbor in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fgoharbor%2Fharbor . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:53 UTC. The most recent advisory here was published 2026-03-26. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page