Harbor Default Credentials: A Case Study in Container Registry Security

#Introduction

During a routine reconnaissance engagement, we identified an exposed Harbor Container Registry instance at harbor.example-registry.internal. Harbor is an open-source container registry used by organizations to store, sign, and scan container images. When misconfigured, it can leak the entire software supply chain of an organization.

This post documents our discovery, the impact assessment, and the responsible disclosure process.

#Discovery

The instance was identified through standard subdomain enumeration. Upon navigating to the Harbor web UI, we were prompted for login credentials. We tested the default credentials that ship with every Harbor installation:

• Username: admin
• Password: Harbor12345

The login succeeded immediately.

#What We Found

Once logged in, we had full administrative access to the registry. The instance contained:

• 65 container repositories across 7 projects
• Approximately 92 GB of container images
• Repositories belonging to the registry operator organization (59 repos), including production services, monitoring stacks, and internal tooling
• A Mattermost project with OIDC-enabled images suggesting Keycloak integration
• A personal user project with personal images

Notable repositories included:

• registry-operator/opsmondo — the main ops platform
• registry-operator/auth-gateway — authentication gateway service
• registry-operator/monitoring-stack — Prometheus/Grafana infrastructure
• mattermost/mattermost-server — team communication platform
• Various proxy cache repositories for Docker Hub images

#Potential Impact

The exposure of a container registry with administrative access carries severe supply chain risks:

#Responsible Disclosure Timeline

The disclosure process was straightforward — we reported the finding directly to the registry operator, and their team responded the same day. Within hours, the default credentials were disabled and an internal investigation was underway.

#Remediation

The registry operator took the following steps:

1. Rotated credentials — The default admin password was replaced with a strong, unique credential
2. Initiated an RCA — Root cause analysis to determine how long the exposure existed and whether any unauthorized access occurred
3. Incident response — Reviewing image access logs and audit trails

#Recommendations for Organizations Using Harbor

If you run a Harbor instance, here are the minimum security measures you should implement:

1. Never use default credentials. Change the admin password immediately after installation.
2. Enforce strong passwords. Harbor supports configurable password policies — use them.
3. Enable OIDC/LDAP authentication. Integrate with your organization's identity provider rather than using local accounts.
4. Use robot accounts for automation. Robot accounts support granular permissions and can be scoped to specific projects and actions.
5. Enable vulnerability scanning. Harbor's built-in scanner (Trivy, Clair) should be mandatory for all projects.
6. Set up audit logging. Monitor login attempts, image pulls, and configuration changes.
7. Restrict network access. Harbor should not be exposed to the public internet. Use VPNs, Cloudflare Tunnels, or IP whitelisting.
8. Tag images immutably. Prevent overwriting existing tags to avoid tag-confusion attacks.

#Conclusion

Default credentials remain one of the most common and most dangerous misconfigurations in production environments. Harbor's default credentials (admin:Harbor12345) are well-known and routinely targeted by automated scanners.

We commend the registry operator for their rapid response and professional handling of this disclosure. Their team acknowledged the issue, took immediate corrective action, and began a thorough RCA — all within hours of our initial report.

#About Firewall Fables

Firewall Fables is a security research initiative focused on identifying and responsibly disclosing vulnerabilities in production systems. Our goal is to make the internet safer by documenting real-world exposures and helping organizations understand how to protect themselves.

If you found this post valuable, consider supporting our work. Donations help us dedicate more time to research and disclosure.

This disclosure followed our standard responsible disclosure process: identify → verify → report → wait for remediation → publish. No sensitive data was extracted or stored during this research.