CVE-2026-92770
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts.
Risk Assessment
A project administrator can recover the scanner adapter secret, risking unauthorized access to scanning infrastructure and further compromise. Credential leakage can undermine container image integrity.
Recommendation
Upgrade Harbor beyond version 2.15.2. Until patched, limit project administrator privileges and rotate scanner adapter secrets.
Other vulnerabilities in Harbor
Original NVD description (English source)
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS