{"id":"GHSA-prh4-vhfh-24mj","aliases":["GO-2026-4876"],"status":"published","title":"Harbor: LDAP password and OIDC secret are not redacted in the audit log","description":"### Impact\nHarbor write configuration payload to audit log when configuration change, the ldap_search_password and oidc_client_secret will be logged in the audit log without redacted\n\n### Patches\nHarbor v2.15.0, v2.14.3, v2.13.5\n\n### Workarounds\nDisable audit log configure event in Harbor Web Console: Go to Administration -\u003e Configuration -\u003e Enable Audit Log Event Type -\u003e Uncheck \"Update Configuration\" and click \"Save\" Button.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-312","CWE-532"],"published":"2026-03-26T22:25:26Z","modified":"2026-04-08T05:18:55Z","fixes":[{"ecosystem":"Go","package":"github.com/goharbor/harbor","fixed_in":["2.13.5","2.14.3","2.13.5+incompatible","2.14.3+incompatible"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.13.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.0"},{"fixed":"2.14.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"2.13.0"},{"fixed":"2.13.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"2.14.0"},{"fixed":"2.14.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"2.13.0+incompatible"},{"fixed":"2.13.5+incompatible"},{"introduced":"2.14.0+incompatible"},{"fixed":"2.14.3+incompatible"}]}]}],"references":[{"url":"https://github.com/goharbor/harbor/security/advisories/GHSA-prh4-vhfh-24mj","tags":["web","advisory"]},{"url":"https://github.com/goharbor/harbor/commit/85e756486fc19333c5c300d7ac273e1580dc9350","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-prh4-vhfh-24mj"},{"url":"https://github.com/goharbor/harbor","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-prh4-vhfh-24mj","title":"Harbor: LDAP password and OIDC secret are not redacted in the audit log","description":"### Impact\nHarbor write configuration payload to audit log when configuration change, the ldap_search_password and oidc_client_secret will be logged in the audit log without redacted\n\n### Patches\nHarbor v2.15.0, v2.14.3, v2.13.5\n\n### Workarounds\nDisable audit log configure event in Harbor Web Console: Go to Administration -\u003e Configuration -\u003e Enable Audit Log Event Type -\u003e Uncheck \"Update Configuration\" and click \"Save\" Button.","status":"published","published":"2026-03-26T22:25:26Z","modified":"2026-03-26T22:25:27Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-312","CWE-532"],"updated_at":"2026-11-02T14:39:43.747579Z"}],"osv":[{"id":"GHSA-prh4-vhfh-24mj","title":"Harbor: LDAP password and OIDC secret are not redacted in the audit log","description":"### Impact\nHarbor write configuration payload to audit log when configuration change, the ldap_search_password and oidc_client_secret will be logged in the audit log without redacted\n\n### Patches\nHarbor v2.15.0, v2.14.3, v2.13.5\n\n### Workarounds\nDisable audit log configure event in Harbor Web Console: Go to Administration -\u003e Configuration -\u003e Enable Audit Log Event Type -\u003e Uncheck \"Update Configuration\" and click \"Save\" Button.","status":"published","published":"2026-03-26T22:25:26Z","modified":"2026-04-08T05:18:55.793745Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-312","CWE-532"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"GO-2026-4876","title":"Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor","description":"Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor","status":"published","published":"2026-04-02T18:42:30Z","modified":"2026-04-02T21:20:01.386819Z","updated_at":"2026-11-02T15:47:02.280725Z"}]}}