Harbor: Mehrere Schwachstellen
NEOSEC enrichment — no mirror of the original source
Ein Angreifer kann mehrere Schwachstellen in Harbor ausnutzen, um Informationen offenzulegen, um seine Privilegien zu erhöhen, um einen Denial of Service durchzuführen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Highbsi:WID-SEC-2026-37681 linked CVE
Open advisory with all CVEs
More on Harbor
Other advisories
- HighCVE-2026-111590Harbor: Mehrere Schwachstellen
- Not ratedCVE-2026-111590Harbor: Server-Side-Request-Forgery (SSRF)
- Not ratedCVE-2026-111590Harbor: Server-Side-Request-Forgery (SSRF)
- Not ratedosv:CVE-2026-111590SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services
- Not ratedosv:CLEANSTART-2026-ZG63410Security fix for CVE-2025-4673 applied in: argo-workflows-fips 3.7.0-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, cert-manager-webhook-pdns-fips 3.0.0-r0, cert-manager-webhook-pdns-fips 3.1.3-r0, cert-manager-webhook-pdns-fips 3.2.3-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, harbor-fips 2.10.3-r0, harbor-fips 2.11.2-r3, harbor-fips 2.12.4-r1, harbor-fips 2.13.2-r1, harbor-registry 3.0.0.1-r2, ingress-nginx-controller 1.24.2-r0, k8ssandra-operator-fips 1.24.0-r0, k8ssandra-operator-fips 3.3.0-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, kyverno-policy-reporter-fips 3.1.3-r6, kyverno-policy-reporter-fips 3.2.2, kyverno-policy-reporter-fips 3.3.2, kyverno-policy-reporter-fips 3.3.2-r0, metrics-server 0.8.0-r0, metrics-server-fips 0.8.0-r3, minio-client-fips 0.20250416181326-r2, minio-client-fips 0.20250521015954-r2, minio-client-fips 0.20250716.153503-r2, minio-client-fips 0.20250721052808-r2, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r0, opensearch-k8s-operator-fips 2.6.1-r0, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r7, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0
- Not ratedosv:CLEANSTART-2026-UZ56675Security fix for CVE-2025-47907 applied in: argo-workflows-fips 3.7.0-r0, cert-manager-webhook-pdns-fips 3.0.0-r0, cert-manager-webhook-pdns-fips 3.1.3-r0, cert-manager-webhook-pdns-fips 3.2.3-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.40.0-r3, dex-fips 2.41.1-r3, dex-fips 2.42.1-r3, dex-fips 2.43.1-r3, druid-exporter-fips 0.10-r0, druid-exporter-fips 0.11-r1, fluent-operator-fips 3.1.0-r3, flux-notification-controller-fips 1.5.0-r0, gomplate 4.3.3-r0, gomplate-fips 4.3.3-r0, gosu 1.17-r5, harbor-fips 2.10.3-r0, harbor-fips 2.11.2-r3, harbor-fips 2.12.4-r1, harbor-fips 2.13.2-r1, harbor-registry 3.0.0.1-r2, k8ssandra-operator-fips 1.24.0-r0, k8ssandra-operator-fips 3.3.0-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, kyverno-fips 1.11.5-r6, kyverno-fips 1.12.7-r5, kyverno-fips 1.14.4-r1, kyverno-policy-reporter-fips 3.0.7-r5, kyverno-policy-reporter-fips 3.1.3-r6, kyverno-policy-reporter-fips 3.2.2, kyverno-policy-reporter-fips 3.3.2, kyverno-policy-reporter-fips 3.3.2-r0, kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r2, kyverno-policy-reporter-kyverno-plugin-fips 1.5.2-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.6.4-r1, metrics-server 0.8.0-r0, metrics-server-fips 0.8.0-r3, minio-client-fips 0.20250416181326-r2, minio-client-fips 0.20250521015954-r2, minio-client-fips 0.20250716.153503-r2, minio-client-fips 0.20250721052808-r2, minio-operator-fips 4.5.8-r3, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r0, opensearch-k8s-operator-fips 2.6.1-r0, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r7, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0
- Not ratedosv:CLEANSTART-2026-YD16450Security fix for CVE-2025-4674 applied in: cert-manager-webhook-pdns-fips 3.0.0-r0, cert-manager-webhook-pdns-fips 3.1.3-r0, cert-manager-webhook-pdns-fips 3.2.3-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, go-discover-fips 0_git20250325-r0, harbor-registry 3.0.0.1-r2, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.6.1-r7, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0
- Not ratedosv:CLEANSTART-2026-JX33746Security fix for CVE-2025-54410 applied in: argo-workflows-fips 3.5.15-r1, consul-k8s-fips 1.5.9-r0, elastic-beats 8.18.1-r0, elastic-beats 9.2.8-r0, elastic-beats 9.3.3-r0, harbor-fips 2.11.2-r5, harbor-scanner-trivy 0.35.1-r0, harbor-scanner-trivy-fips 0.35.1-r0, kyverno-fips 1.12.7-r6, openbao-fips 2.2.2-r6, openbao-fips 2.3.2-r4, paranoia 0.2.1-r0, promxy 0.0.93-r1, rancher-agent 2.11.15-r1
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3768
ID