Executive brief
Harbor is an open-source container registry used by organizations to store and manage container images. Project administrators can exploit a flaw in the query filtering mechanism to gradually extract the scanner adapter secret credentials character-by-character, compromising the security of scanner integrations and potentially exposing container image scan data or enabling unauthorized scanning operations.
Technical details
Harbor's generic list APIs convert the 'q' query parameter into ORM WHERE clauses, with fields being filterable unless explicitly marked with filter:"false". This vulnerability is an incomplete fix for CVE-2025-30086, where the AccessCredential column on scanner registration objects was not properly restricted from fuzzy filtering. A project administrator can leverage response row counts to perform a character-by-character brute-force recovery of the scanner adapter secret, reconstructing the full credential through Boolean-based inference. Authentication as a project administrator is required; the attack vector is network-accessible API endpoints. Affected versions are through 2.15.2; patches are expected in subsequent releases.
Affected products
- goharbor Harbor through 2.15.2
Timeline
- 2026-09-16: disclosed