CVE-2026-92770

Executive Summary

CVE-2026-92770 is an information-disclosure vulnerability in the Harbor container registry through version 2.15.2, in which the q query parameter used to filter scanner registration records fails to properly restrict access to the AccessCredential column. A user holding the project administrator role can abuse fuzzy string filtering on that column and reconstruct the scanner adapter secret one character at a time by observing differences in response row counts. The result is unauthorized recovery of a privileged credential, rated CVSS 6.5 (High confidentiality impact, network attack vector, low privileges required), with no public exploit or vendor patch currently available.

Technical Analysis

Harbor is an open-source container image registry that exposes REST APIs for managing projects, users, scanner registrations, and related metadata. Scanner registrations associate a registry deployment with a vulnerability scanner adapter (for example, Trivy or Clair) and store connection information, including an AccessCredential value used to authenticate the registry to the scanner adapter.

The NVD description states that Harbor "through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials." This identifies the root cause as improper access control / information exposure (CWE-200) on a data-filtering endpoint. The q parameter is the standard Harbor API construct for filtering list responses. Because filtering is applied against the AccessCredential column without adequate authorization or output sanitization, an attacker can submit crafted q filter expressions that are evaluated directly against the secret value.

The critical mechanism is a fuzzy-filter oracle: the API does not return the secret itself, but returns a count of matching rows (or an equivalent presence/absence signal) based on whether the supplied filter pattern matches the stored credential. By iterating candidate patterns character by character, an attacker converts a boolean/count side channel into full recovery of the secret. This is closely analogous to a blind extraction attack (sometimes described as a "blind regex/prefix oracle"), where the query result set size leaks one bit of information per request.

Key characteristics derived strictly from the provided data:

• Attack surface: the Harbor API endpoint that lists/filters scanner registrations (q parameter). No authentication bypass is required beyond a valid account with project administrator privileges (PR:L).
• Necessary privilege: project administrator role, which is sufficient to reach the vulnerable filtering logic.
• Weakness class: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), with an access-control subtext — the filter behavior should not permit querying the credential column.
• Exploit complexity: AC:L (low) and UI:N (none) — exploitation is automated and repeatable.
• Confidentiality impact: C:H — the recovered AccessCredential is a secret intended to authenticate to a scanner adapter.
• Integrity/availability impact: none per the CVSS vector (I:N/A:N).

No further implementation detail (endpoint path, parameter serialization, database backend, or exact response schema) is present in the supplied intelligence. Those specifics are therefore not asserted here. No public PoC, Nuclei template, or exploit code is known.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (blind filter-based secret extraction) and the privileges explicitly stated in the NVD description.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-reachable Harbor instance at or below version 2.15.2, for example via the Harbor login or API banner page. The attacker obtains or is granted a valid account and must hold the project administrator role for the target project. The presence of at least one configured scanner registration (required for the secret to exist) is confirmed.

2. Triggering the flaw. Using the Harbor API, the attacker issues filtered requests to the scanner registration listing endpoint, supplying crafted values in the q parameter. The supplied filter targets the AccessCredential column. Because the filter is improperly restricted, the API evaluates the pattern against the stored secret instead of ignoring or denying that column.

3. Payload / execution at the vulnerability-class level. The attacker applies a blind extraction technique — a fuzzy or prefix match built one character at a time. For each request, the response row count (or match/no-match signal) reveals whether the guessed pattern matched the stored credential. The attacker iterates over the character set, extending the known prefix until the complete secret is recovered. Each guess is a low-cost request; total requests scale roughly with (secret length × alphabet size).

4. Post-exploitation impact. With the AccessCredential recovered, the attacker possesses a secret that Harbor uses to authenticate to the scanner adapter. Depending on the adapter's configuration and trust relationships, this credential may permit access to the scanner service, injection of scan configurations or results, or lateral movement toward systems the scanner can reach. Because the attacker is already a project administrator, the primary gain is escalation from project-scoped administrative rights to possession of a service credential that the UI/API does not intentionally disclose. No integrity or availability impact to Harbor itself is indicated by the CVSS vector.

Impact Assessment

Business impact centers on credential breach rather than service disruption. A project administrator — an already-privileged but not necessarily trusted-insider role — can extract a scanner adapter secret that the platform is expected to keep confidential. This undermines the secrecy of the scanner integration and can enable downstream access to the vulnerability-scanner infrastructure, potentially affecting supply-chain assurance workflows that depend on trusted scanning.

CVSS 3.1 subscores and their meaning:

• AV:N (Network) — exploitable remotely over the Harbor API.
• AC:L (Low) — no special conditions or race needed.
• PR:L (Low) — requires a project administrator account.
• UI:N (None) — fully automatable, no victim interaction.
• S:U (Unchanged) — impact stays within the Harbor security authority.
• C:H (High) — full recovery of the credential; base score 6.5.

Blast radius: every Harbor deployment running through 2.15.2 that has configured scanner registrations and grants project administrator rights to more than a minimal set of users. Multi-tenant environments with delegated project administration are most exposed. Severity is bounded by the fact that no integrity or availability impact is present and that exploitation requires an authenticated privileged role, but the confidentiality loss is complete for the targeted secret. There is no CISA KEV listing, no confirmed in-the-wild exploitation, and no assigned EPSS score at the time of writing.

Detection Guidance

Sigma Rule

title: Harbor Scanner Registration AccessCredential Filter Abuse id: 7f3c9a2e-5b41-4c8d-9e2a-harbor-accreds status: experimental description: Detects repeated API requests to Harbor scanner registration listing with q parameter targeting AccessCredential, indicative of blind secret extraction. references:

• https://nvd.nist.gov/vuln/detail/CVE-2026-92770 author: valtersit.com date: 2026-01-01 logsource: product: harbor service: http detection: selection_endpoint: cs-uri-path|contains:
  • '/api/v2.0/scanners'
  • '/scanners' selection_param: cs-uri-query|contains:
  • 'q='
  • 'accesscredential'
  • 'AccessCredential' condition: selection_endpoint and selection_param fields:
• client_ip
• cs-uri-query
• cs-username falsepositives:
• Legitimate administrative searches on scanner metadata (rare) level: medium tags:
• attack.t1213
• cve.2026.92770

YARA Rule

rule CVE_2026_92770_Harbor_AccessCredential_Filter
{
    meta:
        description = "Detects suspicious Harbor scanner registration filter requests abusing the q parameter against AccessCredential"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92770"
        cve = "CVE-2026-92770"

    strings:
        $api = "/api/v2.0/scanners" ascii nocase
        $acc = "accesscredential" ascii nocase
        $param = "q=" ascii nocase
        $filt = "name=~" ascii nocase

    condition:
        ($api and $param and $acc) or ($api and $filt and $acc)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92770 Harbor Scanner Registration AccessCredential Filter Abuse"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v2.0/scanners"; http.uri; content:"q="; http.uri; content:"accesscredential"; nocase; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-recon; reference:cve,2026-92770; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92770; sid:9277001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s [http where url.path like "/api/v2.0/scanners*" and url.query like "q=" and url.query like "accesscredential"] with runs=20

Splunk SPL Query

index=harbor sourcetype=harbor:http | where like(lower(uri_query), "%q=%") AND like(lower(uri_query), "%accesscredential%") | stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips by user, uri_path, uri_query | where count >= 20 | convert ctime(first_seen) ctime(last_seen) | sort - count

Wazuh OSSEC Rule

json /api/v2.0/scanners q= AccessCredential CVE-2026-92770: potential Harbor scanner AccessCredential filter abuse (blind secret extraction) T1213 927700 CVE-2026-92770: high-frequency AccessCredential filter requests from single source (likely automated extraction)

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or official workaround is available; the following are defensive measures only.

1. Immediate mitigations

• Restrict who can hold the project administrator role; audit and reduce assignments, especially in multi-tenant deployments.
• Apply network controls (segmentation, allowlisting, WAF) to limit access to the Harbor API to trusted networks. Where possible, add a WAF/reverse-proxy rule that rejects requests whose q parameter references the AccessCredential column.
• Enable and centralize Harbor API audit logging; monitor for bursts of scanner-listing requests with q filters as described in the Detection Guidance section.
• Treat scanner adapter credentials as potentially compromised and rotate them on a schedule, particularly if unusual query activity is observed.

2. Patch/upgrade steps

• No patched version is currently identified. Track the Harbor project's security advisories and release notes for 2.15.x and later; upgrade promptly once a fixed release is published.
• Until a fix exists, consider disabling or minimizing configured scanner registrations where they are not operationally required, reducing the number of secrets exposed to the oracle.

3. Long-term hardening

• Enforce least privilege and strict role-based access control on Harbor project administration.
• Perform code-level review of API filtering logic to ensure sensitive columns (such as credentials) are never queryable through user-supplied filters; adopt default-deny column allowlists for q parameters.
• Implement rate limiting and anomaly detection on API endpoints that accept filter parameters.
• Integrate secret-scanning and rotation policies for all registry-to-scanner credentials.

References

• NVD — CVE-2026-92770: https://nvd.nist.gov/vuln/detail/CVE-2026-92770
• MITRE CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1213 (Data from Information Repositories): https://attack.mitre.org/techniques/T1213/
• Harbor project security advisories and release notes: https://github.com/goharbor/harbor/security/advisories
• FIRST EPSS: not yet scored for CVE-2026-92770 (no dataset entry at time of writing)

No threat actor campaigns or exploit-in-the-wild activity have been reported for CVE-2026-92770. CISA KEV does not list this CVE. No public PoC, Nuclei template, or exploit code was identified in the supplied intelligence; the attack chain above is inferred from the vulnerability class and the privilege level stated in the NVD description.

◈ SOURCE Analysis & enrichment: valtersit.com/cve/CVE-2026-92770/ · CVE data: NVD/MITRE (public domain) · © 2026 ValtersIT Hub