CVE-2026-92770

Harbor through 2.15.2 fails to restrict the q query-parameter filtering on scanner registration records, leaving the AccessCredential column open to server-side fuzzy matching (CWE-200, information exposure). A user holding the project administrator role can issue crafted filter queries against the scanner registration API and use the returned row counts as an oracle, recovering the scanner adapter's stored secret one character at a time. With that secret, a semi-trusted project-level administrator can authenticate to the scanner adapter service, gaining access to scanner capabilities and data beyond their intended privileges. Any Harbor deployment that assigns the project administrator role to users who should not see scanner credentials is affected, particularly where a scanner adapter with access credentials is configured. No public proof-of-concept is known, the flaw is not in CISA KEV, and no exploitation has been confirmed.

What to do: Upgrade Harbor to a release newer than 2.15.2 that restricts q-parameter filtering on the AccessCredential field as soon as one is available. In the interim, limit the project administrator role to fully trusted users, audit API logs for unusual q-filter queries against scanner registration list endpoints, and rotate scanner adapter credentials after patching.