CVE-2026-92770: Harbor Information Disclosure Vulnerability

CVE-2026-92770 Overview

CVE-2026-92770 affects Harbor container registry versions through 2.15.2. The vulnerability allows project administrators to extract scanner adapter secrets through the q query parameter on scanner registration endpoints. Harbor fails to restrict fuzzy filtering on the AccessCredential column, enabling character-by-character credential extraction based on HTTP response row counts. The flaw is classified under [CWE-200] as an information exposure issue affecting authenticated users with project administrator privileges.

Critical Impact
Authenticated project administrators can recover scanner adapter secrets one character at a time by observing response row counts from filtered API queries, exposing credentials used to authenticate Harbor to external scanner services.

Affected Products

Harbor container registry versions through 2.15.2
Harbor scanner registration API endpoints
Deployments exposing the AccessCredential field via q parameter filtering

Discovery Timeline

2026-09-16 - CVE-2026-92770 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92770

Vulnerability Analysis

Harbor is an open-source container image registry that integrates with external vulnerability scanners through registered scanner adapters. Each scanner registration stores an AccessCredential value that Harbor uses to authenticate to the scanner service. The vulnerability resides in how Harbor exposes scanner list endpoints to project administrators.

The API accepts a q query parameter that performs fuzzy filtering against database columns, including the sensitive AccessCredential column. A project administrator can submit repeated queries with incrementing candidate substrings and observe whether matching rows are returned in the response. This oracle behavior enables exact reconstruction of the stored secret character by character.

The root cause is a missing allowlist of filterable columns combined with fuzzy LIKE matching over credential storage. Sensitive fields should be excluded from user-controllable filter expressions.

Root Cause

Harbor's scanner data access layer permits the q parameter to target arbitrary model columns, including AccessCredential. The scanner model definition and shared DAO patterns do not mark credential fields as non-filterable. Refer to the Harbor scanner model source and user DAO source for the field definitions involved.

Attack Vector

Exploitation requires network access to the Harbor API and valid project administrator credentials. The attacker submits successive requests such as GET /api/v2.0/scanners?q=access_credential=~<candidate> and inspects whether the response returns a matching row. By expanding the prefix one character at a time, the attacker reconstructs the complete secret without ever reading it directly. Full technical details are available in the VulnCheck advisory and the public write-up.

No verified proof-of-concept code is published in the enriched data. The technique follows standard blind boolean-based extraction against a fuzzy filter oracle.

Detection Methods for CVE-2026-92770

Indicators of Compromise

High-volume sequential GET requests to /api/v2.0/scanners or related scanner endpoints from a single authenticated session
Repeated q parameter values referencing access_credential or containing incrementally growing substring patterns
Bursts of API requests from project administrator accounts followed by outbound connections to scanner services using previously valid credentials

Detection Strategies

Alert on any Harbor API request whose q parameter includes the substring access_credential, since legitimate UI workflows do not filter on this column
Baseline scanner list API call rates per user and flag deviations exceeding typical administrative activity
Correlate authenticated project administrator activity with subsequent scanner authentication failures that may indicate credential misuse or rotation events

Monitoring Recommendations

Enable verbose access logging for Harbor core API endpoints and forward logs to a centralized analytics platform for query inspection
Track unique q parameter values per user session and retain them for retrospective hunting
Monitor scanner adapter authentication events on downstream services (Trivy, Clair, third-party scanners) for unexpected source addresses

How to Mitigate CVE-2026-92770

Immediate Actions Required

Upgrade Harbor to a fixed release once published by the Harbor project; track the Harbor repository for the patched version
Rotate all scanner adapter secrets configured in Harbor, assuming they may have been extracted by any account with project administrator access
Audit project administrator role assignments and revoke unnecessary privileges to reduce the population of accounts able to exploit the flaw
Review Harbor API access logs for historical q parameter abuse targeting access_credential

Patch Information

At publication time the enriched data does not list a fixed version. Consult the Harbor project repository and the VulnCheck advisory for the current remediation status. Versions through 2.15.2 are confirmed vulnerable.

Workarounds

Deploy a reverse proxy or web application firewall rule that rejects Harbor API requests whose q parameter references access_credential
Restrict Harbor API exposure to trusted networks and enforce multi-factor authentication for administrative accounts
Temporarily replace long-lived scanner credentials with short-lived tokens where the scanner integration supports them

bash

# Example NGINX rule to block q parameters referencing access_credential
location /api/ {
    if ($args ~* "(^|&)q=[^&]*access_credential") {
        return 403;
    }
    proxy_pass http://harbor_core;
}