Harbor 2.14.1: known vulnerabilities

2 known CVEs affect Harbor 2.14.1: 1 by NVD's exact CPE match, and 1 more that the Harbor project's advisories list and NVD has not analyzed.

2.14.1 carries the same 2 known CVEs as 11 other Harbor release s. The full detail, the upgrade path and the other affected versions are on the page for 2.12.4 to 2.15.0 , which is this page's canonical.

NVD's count evaluates NVD's published version ranges against this version; those ranges do not carry the Harbor project's per-branch fixes, so the NVD column can read the same on either side of a fix that the Harbor project names. Where NVD has not analyzed a record, the row reads "no NVD data", not "no".

Known CVEs
2
Critical 1 Medium 1
1 critical, 1 medium
Released
November 24, 2025
Per the Harbor project's release pages.
End of life
the Harbor project lists no end-of-life date for this version.
Behind latest
220 days behind 2.15.2 (released July 2, 2026).

Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), the Harbor project's security advisories, release notes and end-of-life page. Pulled September 21, 2026. Every CVE row links to its NVD record and to the vendor's advisory.

CVEs that affect 2.14.1 (2)

Two verdicts per row, side by side: what NVD's exact CPE match says, and what the Harbor project's own CVE record says. A CVE counts when either source says affected. Open a row's sources for the raw ranges.

CVEs that affect Harbor 2.14.1
CVE-2026-4404 published March 23, 2026

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

 Critical9.4 CVSS 3.1 9.4, rated by the CNA yes yes No fixed version on any branch in the Harbor project's record. Latest: 2.15.2.
Sources for CVE-2026-4404 and 2.14.1
NVD range
NVD configuration (NVD status: Analyzed): through 2.15.0. NVD record
the Harbor project range
the Harbor project's CVE record: from 0.1.0 through 2.15.0. the Harbor project advisory
CVE-2026-92770 published September 16, 2026

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts.

 Medium6.5 CVSS 3.1 6.5, rated by the CNA no NVD data yes No fixed version on any branch in the Harbor project's record. Latest: 2.15.2.
Sources for CVE-2026-92770 and 2.14.1
NVD range
NVD has published no version configuration for this record (NVD status: Received). NVD record
the Harbor project range
the Harbor project's CVE record: from 0 through 2.15.2. the Harbor project advisory
16 other Harbor CVEs on record that do not affect 2.14.1

Each of these is fixed at or before 2.14.1 on its branch, or its published range does not include this version. The fix column shows the fix this version already carries.

Harbor CVEs on record that do not affect 2.14.1
CVE-2022-31668 published November 14, 2024 High7.7 CVSS 3.1 7.7, rated by NVD no no CNA range No CNA range for this CVE (assigned by vmware); NVD's published range does not include this version.
Sources for CVE-2022-31668 and 2.14.1
NVD range
NVD configuration (NVD status: Analyzed): from 2.0.0 (including), before 2.4.3; from 2.5.0 (including), before 2.5.2. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by vmware). the Harbor project advisory
CVE-2022-31669 published November 14, 2024 High7.7 CVSS 3.1 7.7, rated by NVD no no CNA range No CNA range for this CVE (assigned by vmware); NVD's published range does not include this version.
Sources for CVE-2022-31669 and 2.14.1
NVD range
NVD configuration (NVD status: Analyzed): from 2.0.0 (including), before 2.4.3; from 2.5.0 (including), before 2.5.2. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by vmware). the Harbor project advisory
CVE-2022-31670 published November 14, 2024 High7.7 CVSS 3.1 7.7, rated by NVD no no CNA range No CNA range for this CVE (assigned by vmware); NVD's published range does not include this version.
Sources for CVE-2022-31670 and 2.14.1
NVD range
NVD configuration (NVD status: Analyzed): from 1.0.0 (including), before 1.10.13; from 2.0.0 (including), before 2.4.3; from 2.5.0 (including), before 2.5.2. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by vmware). the Harbor project advisory
CVE-2022-46463 published January 13, 2023 High7.5 CVSS 3.1 7.5, rated by NVD no no CNA range No CNA range for this CVE (assigned by MITRE); NVD's published range does not include this version.
Sources for CVE-2022-46463 and 2.14.1
NVD range
NVD configuration (NVD status: Modified): from 1.1.0 (including), through 2.5.3. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by MITRE). the Harbor project advisory
CVE-2022-31671 published November 14, 2024 High7.4 CVSS 3.1 7.4, rated by NVD no no CNA range No CNA range for this CVE (assigned by vmware); NVD's published range does not include this version.
Sources for CVE-2022-31671 and 2.14.1
NVD range
NVD configuration (NVD status: Analyzed): from 2.0.0 (including), before 2.4.3; from 2.5.0 (including), before 2.5.2. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by vmware). the Harbor project advisory
CVE-2023-20902 published November 9, 2023 Medium6.5 CVSS 3.1 6.5, rated by NVD no no CNA range No CNA range for this CVE (assigned by vmware); NVD's published range does not include this version.
Sources for CVE-2023-20902 and 2.14.1
NVD range
NVD configuration (NVD status: Modified): before 1.10.17; from 2.6.0 (including), through 2.6.4; from 2.7.0 (including), before 2.7.3; from 2.8.0 (including), before 2.8.3. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by vmware). the Harbor project advisory
CVE-2022-31667 published November 14, 2024 Medium6.4 CVSS 3.1 6.4, rated by NVD no no CNA range No CNA range for this CVE (assigned by vmware); NVD's published range does not include this version.
Sources for CVE-2022-31667 and 2.14.1
NVD range
NVD configuration (NVD status: Analyzed): from 2.0.0 (including), before 2.4.3; from 2.5.0 (including), before 2.5.2. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by vmware). the Harbor project advisory
CVE-2024-22244 published June 10, 2024 Medium6.1 CVSS 3.1 6.1, rated by NVD no no This version is outside the affected range.
Sources for CVE-2024-22244 and 2.14.1
NVD range
NVD configuration (NVD status: Analyzed): from 2.8.0 (including), before 2.8.5; from 2.9.0 (including), before 2.9.3; exactly 2.10.0. NVD record
the Harbor project range
the Harbor project's CVE record: from 2.8.0 through 2.8.4; from 2.10.0 through 2.10.0. the Harbor project advisory
CVE-2024-22261 published June 11, 2024 Medium5.5 CVSS 3.1 5.5, rated by NVD no no This version is outside the affected range.
Sources for CVE-2024-22261 and 2.14.1
NVD range
NVD configuration (NVD status: Analyzed): from 2.8.1 (including), before 2.8.6; from 2.9.0 (including), before 2.9.4; from 2.10.0 (including), before 2.10.2. NVD record
the Harbor project range
the Harbor project's CVE record: from 2.8.1 through 2.8.5; from 2.9.0 through 2.9.3; from 2.10.0 through 2.10.1. the Harbor project advisory
CVE-2022-31666 published November 14, 2024 Medium5.4 CVSS 3.1 5.4, rated by NVD no no CNA range No CNA range for this CVE (assigned by vmware); NVD's published range does not include this version.
Sources for CVE-2022-31666 and 2.14.1
NVD range
NVD configuration (NVD status: Analyzed): from 2.0.0 (including), before 2.4.3; from 2.5.0 (including), before 2.5.2. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by vmware). the Harbor project advisory
CVE-2019-19030 published December 26, 2022 Medium5.3 CVSS 3.1 5.3, rated by NVD no no CNA range No CNA range for this CVE (assigned by MITRE); NVD's published range does not include this version.
Sources for CVE-2019-19030 and 2.14.1
NVD range
NVD configuration (NVD status: Modified): before 1.10.3; from 2.0.0 (including), before 2.0.1. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by MITRE). the Harbor project advisory
CVE-2020-29662 published February 2, 2021 Medium5.3 CVSS 3.1 5.3, rated by NVD no no CNA range No CNA range for this CVE (assigned by MITRE); NVD's published range does not include this version.
Sources for CVE-2020-29662 and 2.14.1
NVD range
NVD configuration (NVD status: Modified): from 2.0 (including), before 2.0.5; from 2.1.0 (including), before 2.1.2. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by MITRE). the Harbor project advisory
CVE-2020-13788 published July 15, 2020 Medium4.3 CVSS 3.1 4.3, rated by NVD no no CNA range No CNA range for this CVE (assigned by MITRE); NVD's published range does not include this version.
Sources for CVE-2020-13788 and 2.14.1
NVD range
NVD configuration (NVD status: Modified): before 2.0.1. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by MITRE). the Harbor project advisory
CVE-2020-13794 published September 30, 2020 Medium4.3 CVSS 3.1 4.3, rated by NVD no no CNA range No CNA range for this CVE (assigned by MITRE); NVD's published range does not include this version.
Sources for CVE-2020-13794 and 2.14.1
NVD range
NVD configuration (NVD status: Modified): from 1.9.0 (including), before 2.0.3. NVD record
the Harbor project range
the Harbor project publishes no affected range in the CVE record (assigned by MITRE). the Harbor project advisory
CVE-2024-22278 published August 2, 2024 Medium4.3 CVSS 3.1 4.3, rated by NVD no no This version is outside the affected range.
Sources for CVE-2024-22278 and 2.14.1
NVD range
NVD configuration (NVD status: Modified): before 2.9.5; from 2.10.0 (including), before 2.10.3. NVD record
the Harbor project range
the Harbor project's CVE record: from 2.9.4 before 2.9.5; from 2.10.2 before 2.10.3. the Harbor project advisory
CVE-2025-32019 published July 23, 2025 Medium4.1 CVSS 3.1 4.1, rated by the CNA no NVD data no This version is outside the affected range.
Sources for CVE-2025-32019 and 2.14.1
NVD range
NVD has published no version configuration for this record (NVD status: Deferred). NVD record
the Harbor project range
the Harbor project's CVE record: from 0 before 2.11.3; from 2.12.0 before 2.12.4; from 2.13.0 before 2.13.1. the Harbor project advisory

About this page and CloudRepo

CloudRepo is a managed artifact repository, so there is no Artifactory or Nexus server for you to patch. In over 10 years of operation, CloudRepo has experienced no known security breaches. This page is not a scan of your server: the data is NVD's and the vendor's, linked on every row, pulled on September 21, 2026.