Identifying a BOLA Vulnerability in Harbor, a Cloud-Native Container Registry
Summary: Unit 42 researchers identified a broken object-level authorization (BOLA) vulnerability, tracked as CVE-2024-22278 with a CVSS score of 6.4, affecting Harbor container registry versions prior to 2.9.5. The flaw lets a user with a Maintainer role create, update and delete a project's metadata through the API, actions the Harbor UI and official documentation restrict to the ProjectAdmin role.
Key Takeaway: A Maintainer account can make a private project public, deploy unverified images and bypass mandatory vulnerability scanning - so an attacker who lands that role gets ProjectAdmin-level changes on a registry holding your container images.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-22278
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026