Critical 9.4 CVSS Flaw Exposes Harbor Registries to Total Hijack

CERT/CC warns of CVE-2026-4404: Harbor installs with a default administrative account (username "admin", password "Harbor12345") and does not enforce a password change, allowing remote attackers to gain full administrative access to container registries. Consequences include supply-chain image poisoning, creation of persistent robot/API accounts, data exfiltration via replication, and disabling of signature enforcement or vulnerability scanning; operators are advised to change the harbor_admin_password and upgrade to Harbor 2.15.0 or later where the default-credential issue is addressed.