Harbor: fuzzy q filter on scanner credentials lets a project admin extract the adapter secret character by character

Impact

Harbor through 2.15.2 lets the q query parameter apply fuzzy matching to the AccessCredential column of scanner registrations. A project administrator can binary-search the scanner adapter secret one character at a time by watching how many rows come back, recovering the full credential without ever being shown it. That secret authenticates Harbor to the vulnerability scanner adapter, so recovering it gives a tenant-level admin a credential that was meant to be registry-global. In a GPU cloud where Harbor is the shared registry for every tenant's model and CUDA images, the blast radius is the scanner integration for the whole instance, not one project.

Who can reach it

Network access to the Harbor API as an authenticated project administrator - a role routinely handed to tenants who own a namespace of images.

What to do

Upgrade Harbor past 2.15.2 once a fixed release is published and restart the Harbor core service; no fixed version is named in the record. In the meantime rotate the scanner adapter credential and re-register the scanner, and audit which accounts hold project-admin on shared projects. Registry-side change only; running GPU workloads are unaffected, though image pulls pause briefly during the restart.

References

Related entries

• runc: Volume-mount race gives incorrect access control and privilege escalation to hostCVE-2019-19921 · runcHigh
• Podman: File permissions not checked for non-root users in a privileged containerCVE-2021-20188 · PodmanHigh
• runc: Regression of CVE-2019-19921: incorrect access control leading to privilege escalation via volume mountsCVE-2023-27561 · runcHigh
• Slurm: Filesystem race conditions allow gaining ownership of, overwriting, or deleting filesCVE-2023-41914 · SlurmHigh
• Traefik: Service middleware annotation escapes crossProviderNamespaces restrictionsCVE-2026-85594 · Traefik Kubernetes Ingress provider (traefik.ingress.kubernetes.io/service.middlewares annotation)High
• Cilium: A user who can create CiliumNetworkPolicy in one namespace affects traffic cluster-wideCVE-2023-41333 · CiliumMedium