CVE-2026-92770 goharbor CVE debrief

Who should care

Defenders responsible for Harbor deployments, especially those with project administrator access, should assess exposure and prioritize remediation. This includes verifying deployment versions, restricting access, and monitoring for suspicious activity. The vulnerability's impact on defenders necessitates a thorough review of current configurations and the implementation of compensating controls where necessary.

Why it matters

CVE-2026-92770 allows project administrators to recover scanner adapter secrets, requiring defenders to verify and remediate this vulnerability in their Harbor deployments.

• Verify and restrict project administrator access to sensitive data
• Monitor for suspicious activity related to scanner adapter secrets
• Apply remediation or patches provided by the vendor

Technical summary

The vulnerability in Harbor through 2.15.2 allows project administrators to exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts. This vulnerability is significant because it enables project administrators to potentially access sensitive information, emphasizing the need for defenders to verify and remediate this vulnerability in their Harbor deployments, especially those with project administrator access. The technical details involve the exploitation of fuzzy filtering, which can be manipulated to deduce the scanner adapter secret.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their Harbor deployments, especially those with project administrator access.

Recommended defensive actions

• Verify Harbor deployment versions and configurations
• Restrict project administrator access to sensitive data
• Monitor for suspicious activity related to scanner adapter secrets
• Apply remediation or patches provided by the vendor
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows project administrators to recover the scanner adapter secret by exploiting the fuzzy filtering on the AccessCredential column. This can be done one character at a time through response row counts. The exploitation is limited to project administrators and involves analyzing response row counts to deduce the secret.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.