Critical Vulnerability in Harbor Enables Privilege Escalation from Zero to Admin (CVE-2019-16097)
Summary: Unit 42 researcher Aviv Sasson found a critical privilege escalation flaw in the Harbor cloud native registry, CVE-2019-16097, where a POST request to /api/users with the parameter "has_admin_role" set to True creates a new admin user under default settings. The flaw affects versions 1.7.0 through 1.8.2, was made public on September 10, and was fixed in versions 1.7.6 and 1.8.3 released on September 18; a Unit 42 scan found 2,500 Harbor instances online, 1,300 of them vulnerable.
Key Takeaway: An attacker who gains admin this way can download every private project, delete all images, or replace them with malware or crypto miners, and because attackers may remove the users they created, a spot check for unrecognized admin accounts may not surface a compromise.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-16097
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026