CVE-2026-92770 in Harbor
Summary
by MITRE • 09/16/2026
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Harbor versions up to 2.15.2 represents a significant security flaw within the application's handling of query parameters during scanner registration processes. Specifically, the defect lies in the insufficient restriction and validation applied to the q parameter used for filtering access credentials associated with registered scanners. This architectural oversight allows project administrators, who typically possess elevated privileges but are not intended to have full administrative control over system-wide secrets, to exploit a logic error that facilitates unauthorized data exfiltration. The core technical issue stems from fuzzy string matching or partial query execution mechanisms employed by the backend database layer when processing requests for scanner adapter details. Instead of enforcing strict equality checks or proper parameterization that would prevent side-channel information leakage, the application allows queries where the AccessCredential column is matched against a partially constructed search term. This design choice creates an environment where sensitive cryptographic material can be systematically reconstructed through iterative probing rather than being protected by robust access controls or encryption at rest without key management safeguards.
From a technical perspective, this vulnerability enables what is known as a blind SQL injection variant or more accurately, a time-based and count-based side-channel attack. By manipulating the q parameter to include specific character sequences, an attacker can observe variations in the HTTP response row counts returned by the API endpoint responsible for listing scanner credentials. If the guessed character matches the actual credential value at that position, the query returns one additional result compared to when it does not match. This differential behavior allows a malicious actor to reconstruct the entire secret string byte-by-byte or character-by-character without ever seeing the plaintext directly in the response body. The attack is particularly insidious because it bypasses standard input validation checks and relies on the application's legitimate functionality for filtering lists, making detection by traditional web application firewalls difficult unless specific behavioral heuristics are implemented to monitor query patterns and response size anomalies.
The operational impact of this vulnerability is severe due to the nature of the exposed data. Scanner adapter secrets in Harbor serve as authentication tokens or API keys that allow external security scanning tools to interact with the container registry. These credentials often possess permissions to pull, push, and scan images across multiple projects within a harbor instance. If an attacker successfully reconstructs these secrets using the described method, they gain the ability to impersonate legitimate scanner services. This can lead to unauthorized access to private repositories, injection of malicious artifacts into supply chains, or disruption of security scanning pipelines by disabling or manipulating registered scanners. Furthermore, since project administrators are often trusted entities within their respective projects but not necessarily vetted for system-wide secret management, this privilege escalation vector undermines the principle of least privilege and compromises the integrity of the entire container registry infrastructure.
This flaw aligns with CWE-209, which describes an information exposure through an error message or behavioral detail, as well as CWE-613 regarding insufficient session expiration or lack of proper validation in stateful interactions. In terms of the MITRE ATT&CK framework for enterprise systems, this vulnerability facilitates techniques associated with Credential Access and Discovery, specifically allowing adversaries to harvest credentials from application logs or database queries through side-channel analysis rather than direct exploitation of a buffer overflow or code execution flaw. The attack pattern resembles T1087 Account Discovery but adapted for API-based credential harvesting via enumeration.
Mitigation strategies must address both the immediate technical defect and broader architectural practices. Harbor administrators should immediately upgrade to version 2.15.3 or later, where this fuzzy filtering logic has been corrected to enforce strict equality checks on sensitive fields like AccessCredential during list operations. For environments that cannot be patched instantly, network-level controls such as rate limiting on the scanner registration API endpoints can help mitigate brute-force reconstruction attempts by introducing delays between requests. Additionally, implementing Web Application Firewall rules that detect abnormal variations in response payload sizes for similar query parameters may provide a layer of defense against this specific enumeration technique. Long-term remediation should involve auditing all API endpoints for similar fuzzy matching behaviors on sensitive data fields and ensuring that database queries involving secrets are parameterized correctly to prevent any form of inference-based attacks. Regular rotation of scanner adapter credentials further reduces the window of exposure if such vulnerabilities exist in legacy versions or unpatched deployments.