https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T03:14:37.855446+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-harbor-2020-29662 BIT-harbor-2020-29662 2026-10-13T03:14:40.360521+00:00

Affected: Bitnami: harbor

In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.

 https://cve.radiocsirt.org/vuln/euvd-2026-47452 EUVD-2026-47452 2026-10-13T03:14:40.360571+00:00 EUVD-2026-47452 https://cve.radiocsirt.org/vuln/fkie_cve-2020-29662 fkie_cve-2020-29662 2026-10-13T03:14:40.360587+00:00

In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.

 https://cve.radiocsirt.org/vuln/ghsa-38r5-34mr-mvm7 GHSA-38r5-34mr-mvm7 — "catalog's registry v2 api exposed on unauthenticated path in Harbor" 2026-10-13T03:14:40.360611+00:00

Affected: Go: github.com/goharbor/harbor

### **Impact** Javier Provecho, member of the TCCT (Telefonica Cloud & Cybersecurity Tech better known as ElevenPaths) SRE team discovered a vulnerability regarding Harbor’s v2 API.

The catalog’s registry v2 api is exposed on an unauthenticated path. The current catalog API path is served at the following path and it requires to be authenticated as an admin.

"GET /v2/_catalog"

However, the authorization can be bypassed by using the following path

"GET /v2/_catalog/"

### **Patches** If your product uses the affected releases of Harbor, update to either version v2.1.2 or v2.0.5 to fix this issue immediately

https://github.com/goharbor/harbor/releases/tag/v2.1.2 https://github.com/goharbor/harbor/releases/tag/v2.0.5

### **Workarounds** If you cannot access a patched release, it can be mitigated by disabling that API. For example, redirecting it to a 404 sink hole in the ingress.

### **For more information** If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io View our security policy at https://github.com/goharbor/harbor/security/policy https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29662

 https://cve.radiocsirt.org/vuln/gsd-2020-29662 gsd-2020-29662 2026-10-13T03:14:40.360666+00:00 gsd-2020-29662