Search: “harbor”

457 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 112 Malware 99 Vulnerability 61 Exploit / PoC 41 Policy & legal 35 Threat actor 28 Data breach 26 Industry 22 Phishing & fraud 14 Research 6 AI safety & security 4 AI tools & infra 2 Tools 2 Advisory 2

SeverityAll critical 193 high 149 medium 60 low 48 info 7

Identifying a BOLA Vulnerability in Harbor, a Cloud

Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.

Unit 42 researchers identified a broken object-level authorization flaw, CVE-2024-22278, in Harbor, a CNCF-graduated cloud-native container registry with 1.8 million downloads. The flaw (CVSS 6.4) lets users with the Maintainer role create, update, and delete project metadata, actions reserved for ProjectAdmin, risking data exposure, integrity compromise, and circumvention of vulnerability scanning. Harbor patched the issue in versions 2.9.5, 2.10.3, and 2.11.0. The finding came from Unit 42's automated BOLA detection tool built on generative AI.

Palo Alto Unit 42Aug 17, 12:35 UTC · 29d agoVulnerability CVE-2024-22278

HackerOne extends Safe Harbor protections to AI testing

Help Net SecurityJan 20, 00:00 UTC · Jan 20, 2026Vulnerability

High severity vulnerabilities found in Harbor open-source artifact registry

Help Net SecuritySep 19, 00:00 UTC · Sep 19, 2022Vulnerability CVE-2022-31671 CVE-2022-31666 CVE-2022-31670+2 CVEs

Mirantis provides support offerings for Harbor Registry and KubeVirt

Help Net SecurityNov 8, 00:00 UTC · Nov 8, 2024Industry

SailPoint Harbor Pilot automates identity security tasks

Help Net SecurityMar 25, 00:00 UTC · Mar 25, 2025Industry

Millions stolen from crypto platforms Exactly Protocol and Harbor Protocol

The RecordAug 22, 19:53 UTC · Aug 22, 2023Threat actor

At least 1,300 Harbor cloud registry installs open to attack

Security AffairsSep 19, 15:56 UTC · Sep 19, 2019Exploit / PoC CVE-2019-16097

Bugcrowd launches Disclose.io to provide a safe harbor for white hat hackers

Help Net SecurityAug 6, 00:00 UTC · Aug 6, 2018Ransomware

We got admin access to Baseten's production GitHub in 25 minutes

Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.

Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.

Hacker News · AI18:11 UTC · 4h agoVulnerability HN 51↑ · 12 comments1

Harnessing LLMs for Automating BOLA Detection

Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.

Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.

Palo Alto Unit 42Aug 17, 12:34 UTC · 29d agoResearch CVE-2024-1313 CVE-2024-22278 CVE-2023-3285+14 CVEs