CVE-2024-22278: Authorization Bypass in Harbor Container Registry

The core of this vulnerability lies in Harbor's insufficient validation of user permissions when updating project configurations. A malicious actor who can exploit this bypass could modify project settings, such as access control lists (ACLs), replication policies, or even image scanning configurations. This could lead to unauthorized image pulls, pushes, or deletions, effectively compromising the integrity and security of the container registry. The blast radius extends to any applications or services relying on images stored within the affected Harbor instance, as an attacker could inject malicious images or manipulate existing ones. Successful exploitation could also enable lateral movement within the infrastructure if the registry is integrated with other systems.

1. Reserved2024-01-08
2. Published2024-08-06
3. Modified2026-03-03
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-22278 is to upgrade Harbor to version 2.9.5+incompatible or later. If an immediate upgrade is not feasible, consider implementing stricter role-based access control (RBAC) policies within Harbor to limit the potential impact of a successful exploit. Review and audit existing project configurations to identify any suspicious changes. While a direct WAF rule is unlikely to be effective, monitoring Harbor's audit logs for unusual permission changes or configuration modifications can provide early detection. After upgrading, confirm the fix by attempting to modify project configurations with a user account that should not have the necessary permissions; the action should be denied.