Authorization bypass through user-controlled key in Harbor - #VU153947
Published: October 7, 2026 / Updated: October 8, 2026
Vulnerability details
The vulnerability allows a remote user to escalate privileges and pull, push, and delete images in every project, including private projects.
The vulnerability exists due to authorization bypass through username-based inheritance of local system-administrator privileges in the Harbor registry API (/v2/) when processing HTTP basic authentication with auth-proxy tokens. A remote user can submit a request using an auth-proxy token for an identity whose username matches a local Harbor system administrator to escalate privileges and pull, push, and delete images in every project, including private projects.
Only deployments using auth_mode = http_auth are affected. The identity provider must authenticate the matching identity, even though the auth proxy does not grant it administrator rights. The Harbor web UI and REST API (/api/v2.0) are not affected.