CVE-2026-92770— Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter
Quick assessment
Affected
goharbor harbor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character a
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92770
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92770
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92770
请登录查看更多情报信息。
Other References for CVE-2026-92770 (4)
-
-
-
🔗 harbor/src/pkg/user/dao/user.go at v2.15.1 · goharbor/harbor · GitHub Read full article technical-description
-
IV. Related Vulnerabilities
Same product: harbor
-
CVE-2026-4404
Use of hard coded credentials in GoHarbor Harbor -
CVE-2025-32019
Harbor's repository description page allows for XSS -
CVE-2022-31668
User permission validation failure and disclosure of P2P pre -
CVE-2022-31667
Harbor fails to validate the user permissions when updating -
CVE-2022-31669
Harbor fails to validate the user permissions when updating
Same weakness: CWE-200
-
CVE-2026-61588
djust's Django model serialization has no sensitive-field de -
CVE-2026-92594
Craft CMS before 5.11.0 Unauthenticated PII Disclosure via G -
CVE-2026-64684
RMCP: Custom HTTP headers leak to cross-origin redirect targ -
CVE-2026-92811
browserless 1.44.0 through 2.56.7 File Protocol Restriction -
CVE-2026-20360
Cisco Nexus Dashboard Software Security Hardening Release Se
V. Comments for CVE-2026-92770
No comments yet