CVE-2026-92770: Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Harborto a version that resolves this vulnerability.Fixed in 2.15.2 - Compensating control
Mitigate by restricting access to Harbor scanner registration endpoints so unauthorized users cannot exploit fuzzy filtering of the AccessCredential column to infer the scanner adapter secret via response row counts.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Harbor project administrator can exploit it. The disclosed data is the scanner adapter secret associated with scanner registration access credentials.
What access and interaction does exploitation require?
Exploitation requires project-administrator privileges and network access to Harbor. No user interaction is required, and the attacker can infer the secret one character at a time by observing response row counts from q parameter filtering.
Which Harbor versions are identified as affected?
Harbor through version 2.15.2 is identified as affected. The provided data does not identify a fixed version.