Harbor: known vulnerabilities by version

The Harbor project lists 85 Harbor 2.x versions. 85 of them carry at least one known CVE by NVD's exact CPE match or the Harbor project's advisories and have a page here; none is free of known CVEs. 18 CVEs are on record. Latest release: 2.15.2 (July 2, 2026).

Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), the Harbor project's security advisories, release notes and end-of-life page. Pulled September 21, 2026. Every CVE row links to its NVD record and to the vendor's advisory.

Check a Harbor version

Paste the version your server reports. Build suffixes such as -02 and a leading v are fine.

Every version, by branch

Newest branch first. Each version shows its known-CVE count and the Harbor project's end-of-life status. A version without a link has no known CVE and no page.

2.15.x

2.14.x

2.13.x

2.12.x

2.11.x

2.10.x

2.9.x

2.8.x

2.7.x

2.6.x

2.5.x

2.4.x

2.3.x

2.2.x

2.1.x

2.0.x

Named for Harbor, with no version range to place it

One CVE names Harbor and carries no version range that anyone publishes: neither NVD's configurations nor the CVE record says which versions are affected. It appears on no version page and in none of the counts above, and is listed here, in NVD's words, rather than left out.

CVE-2025-30086 CVSS 3.1 4.9, Medium Published July 25, 2025 , NVD status: Deferred

CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user's password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack.

Advisory

About this page and CloudRepo

CloudRepo is a managed artifact repository, so there is no Artifactory or Nexus server for you to patch. In over 10 years of operation, CloudRepo has experienced no known security breaches. This page is not a scan of your server: the data is NVD's and the vendor's, linked on every row, pulled on September 21, 2026.