[harbor] Pinned at v2.14.2 — vulnerable to GHSA-prh4-vhfh-24mj (LDAP/OIDC secrets in audit log) #2739

Summary

Cozystack pins Harbor at v2.14.2, which is vulnerable to GHSA-prh4-vhfh-24mj — LDAP passwords and OIDC client secrets are written unredacted to the audit log. Fixed in Harbor v2.14.3 (released 2026-03-10). All goharbor/* image tags and the vendored harbor-helm chart pin the vulnerable version.

Evidence

• packages/apps/harbor/Chart.yaml:7 — top-level app appVersion

  appVersion: "2.14.2"

• packages/system/harbor/charts/harbor/Chart.yaml:2 — vendored upstream chart's appVersion

  appVersion: 2.14.2

• packages/system/harbor/charts/harbor/Chart.yaml:22 — vendored chart version

  version: 1.18.2

• packages/system/harbor/charts/harbor/values.yaml:500-1069 — every goharbor/* image tag is v2.14.2:
  • :501-502 goharbor/nginx-photon:v2.14.2
  • :531-533 goharbor/harbor-portal:v2.14.2
  • :572-573 goharbor/harbor-core:v2.14.2
  • :661-662 goharbor/harbor-jobservice:v2.14.2
  • :723-725 goharbor/registry-photon:v2.14.2
  • :733-734 goharbor/harbor-registryctl:v2.14.2
  • :813-815 goharbor/trivy-adapter-photon:v2.14.2
  • :918-919 goharbor/harbor-db:v2.14.2
  • :1068-1069 goharbor/harbor-exporter:v2.14.2
• packages/system/harbor/Makefile:6-9 — the update: target re-pulls helm repo add harbor https://helm.goharbor.io && helm pull harbor/harbor. Bumping the chart version is a one-shot make update.

Significance

GHSA-prh4-vhfh-24mj (MODERATE, published 2026-03-26):

"Harbor: LDAP password and OIDC secret are not redacted in the audit log"

Vulnerable: >= 2.14.0, < 2.14.3. First patched version: 2.14.3.

The fix is the cherry-pick "Remove payload from config audit log" (goharbor/harbor#22918) included in v2.14.3. 2.14.3 also carries an additional security fix: "fix(security): reject bearer tokens issued before project creation" (goharbor/harbor#22939), and a base-image refresh.

Threat model:

• Harbor is exposed as a tenant-facing managed registry. LDAP and OIDC are common identity backends in cozystack tenant deployments.
• Audit log is queryable by Harbor admins and any robot account with read on system audit log. On a multi-tenant operator-managed install, that's a wider blast radius than a self-hosted Harbor.
• A leaked LDAP bind password lets an attacker re-bind as the Harbor service principal against the directory; a leaked OIDC client secret lets them impersonate Harbor against the IdP.

Upstream chart harbor-helm v1.18.3 (2026-03-19) is a one-line bump that just sets appVersion: 2.14.3. No values-schema breaking change between 1.18.2 and 1.18.3 — the diff is goharbor/harbor-helm#2327. Harbor v2.14.3 is API-compatible with v2.14.2 by definition (patch release).

Suggested fix

In packages/system/harbor/, run make update (executes helm repo add harbor https://helm.goharbor.io && helm pull harbor/harbor) — that will pull harbor-helm v1.18.3 with appVersion: 2.14.3 and refresh all goharbor/* image tags to v2.14.3 in charts/harbor/values.yaml. Then bump packages/apps/harbor/Chart.yaml:7 appVersion: "2.14.2" to appVersion: "2.14.3" to match. No values-schema migration is required.

Environment

• Cozystack: master @ 09edf16
• Harbor chart: 1.18.2, appVersion 2.14.2