CVE-2026-4404CWE-1393CWE-798hardcoded-credentials

CVE-2026-4404

Critical · published March 23, 2026

CVSS v3.1

9.4

EPSS

Percentile

47.8

In the wild

Unconfirmed

What it is

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

The record

Technical detail

CVSS v3.1: 9.4 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0: Not supplied
EPSS: 0.00595 · 47.8th percentile
Weaknesses: CWE-1393 · Use of Default Password; CWE-798 · Use of Hard-coded Credentials
Published: 2026-03-23T19:16Z

Affected products (1)

Product	Versions	Fixed in
linuxfoundation/harbor	≤ 2.15.0	—

References (5)

https://cwe.mitre.org/data/definitions/1393.html · [email protected]https://github.com/goharbor/harbor/issues/1937 · [email protected]https://github.com/goharbor/harbor/pull/22751 · [email protected]https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345 · [email protected]https://www.kb.cert.org/vuls/id/577436 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

23 MAR 14:47Z
Use of hard coded credentials in GoHarbor Harbor
cvelistv5