Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Harbor and related components may let attackers bypass security
published 1 month ago
Summary
Several Harbor packages contained a flaw that could let an attacker bypass security checks and gain unauthorized access. The problem has been fixed in newer releases of Harbor, Harbor‑FIPS, Harbor‑registry, and the Trivy scanner components. Update to the latest versions listed to protect your system.
What to do
- Update cleanstart harbor to version 2.12.4-r0.
- Update cleanstart harbor to version 2.13.5-r0.
- Update cleanstart harbor to version 2.14.3-r0.
- Update cleanstart harbor to version 2.15.0-r0.
- Update cleanstart harbor-fips to version 2.13.5-r0.
- Update cleanstart harbor-fips to version 2.14.3-r0.
- Update cleanstart harbor-fips to version 2.15.0-r0.
- Update cleanstart harbor-registry to version 3.0.0.1-r3.
- Update cleanstart harbor-registry-fips to version 2.6.2-r0.
- Update cleanstart harbor-registry-fips to version 2.7.1-r0.
- Update cleanstart harbor-registry-fips to version 2.8.3-r0.
- Update cleanstart harbor-registry-fips to version 3.0.0-r0.
- Update cleanstart harbor-registry-fips to version 3.0.0.1-r3.
- Update cleanstart harbor-registry-fips to version 3.0.0.1-r4.
- Update cleanstart harbor-scanner-trivy to version 0.35.1-r0.
- Update cleanstart harbor-scanner-trivy-fips to version 0.35.1-r0.
- Update cleanstart harbor-trivy-adapter-fips to version 0.36.0-r1.
- Update cleanstart rekor-backfill-index to version 1.2.2-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | harbor |
< 2.12.4-r0 < 2.13.5-r0 < 2.14.3-r0 < 2.15.0-r0 Fix: upgrade to 2.12.4-r0
|
| CleanStart | cleanstart | harbor-fips |
< 2.13.5-r0 < 2.14.3-r0 < 2.15.0-r0 Fix: upgrade to 2.13.5-r0
|
| CleanStart | cleanstart | harbor-registry |
< 3.0.0.1-r3 Fix: upgrade to 3.0.0.1-r3
|
| CleanStart | cleanstart | harbor-registry-fips |
< 2.6.2-r0 < 2.7.1-r0 < 2.8.3-r0 < 3.0.0-r0 < 3.0.0.1-r3 < 3.0.0.1-r4 Fix: upgrade to 2.6.2-r0
|
| CleanStart | cleanstart | harbor-scanner-trivy |
< 0.35.1-r0 Fix: upgrade to 0.35.1-r0
|
| CleanStart | cleanstart | harbor-scanner-trivy-fips |
< 0.35.1-r0 Fix: upgrade to 0.35.1-r0
|
| CleanStart | cleanstart | harbor-trivy-adapter-fips |
< 0.36.0-r1 Fix: upgrade to 0.36.0-r1
|
| CleanStart | cleanstart | rekor-backfill-index |
< 1.2.2-r0 Fix: upgrade to 1.2.2-r0
|
Original advisory text
Security fix for CVE-2025-29923 applied in: harbor 2.12.4-r0, harbor 2.13.5-r0, harbor 2.14.3-r0, harbor 2.15.0-r0, harbor-fips 2.13.5-r0, harbor-fips 2.14.3-r0, harbor-fips 2.15.0-r0, harbor-registry 3.0.0.1-r3, harbor-registry-fips 2.6.2-r0, harbor-registry-fips 2.7.1-r0, harbor-registry-fips 2.8.3-r0, harbor-registry-fips 3.0.0-r0, harbor-registry-fips 3.0.0.1-r3, harbor-registry-fips 3.0.0.1-r4, harbor-scanner-trivy 0.35.1-r0, harbor-scanner-trivy-fips 0.35.1-r0, harbor-trivy-adapter-fips 0.36.0-r1, rekor-backfill-index 1.2.2-r0
CVE-2025-29923 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-UK45706 · OSV
Track software like this
Free during beta