DEV Community

OnaEiuspkz
OnaEiuspkz

Posted on

57,482 Harbor Fingerprints and a Documented Default Administrator Password

#harbor #containerregistry #supplychain #defaultcredentials

57,482 Harbor Fingerprints and a Documented Default Administrator Password

A container registry is the one system every cluster in an organisation pulls from. Compromise it and the next deployment is the attack, with no exploit required at the runtime layer.
ZoomEye measurements collected on 28 October 2026 show 57,482 assets matching app="Harbor" and 136,248 matching title="Harbor". The title match is more than twice the fingerprint count, which tells you something about how many web-facing deployments carry the product name without matching the tighter app signature.

What the vendor documentation still says

Harbor's installation documentation describes the harbor_admin_password parameter in the configure-yml reference. The text is precise and it is worth reading exactly: set an initial password for the Harbor system administrator, and that password is used only the first time Harbor starts. On subsequent logins the setting is ignored and the administrator's password is set in the Harbor portal. The same row states that the default username and password are admin and Harbor12345.
Two things follow. A freshly installed registry has a known administrator credential until somebody logs in and changes it. And the changing has to happen through the portal, which means the window between installation and first login is a real window, not a theoretical one.
The parameter's own semantics make this easy to get wrong. An operator who sets harbor_admin_password in harbor.yml, redeploys, and assumes the password is now enforced has misread it. After the first startup the value in the file no longer controls anything. A team that rotates the password in the portal and also edits the YAML file may believe the two are in sync when they are not.

Why a registry is worth more than its login

The administrative account of a registry can push images. That capability is enough to place code into every environment that pulls from it, and the placement happens through the ordinary deployment path that nobody questions.
Beyond images, a registry holds robot accounts with tokens used by CI pipelines. Those tokens often have push rights scoped broadly because scoping them tightly takes an extra step. It also holds project metadata: which teams exist, what they publish, and often the naming conventions that reveal internal architecture.
Harbor 2.x added vulnerability scanning, content trust and replication, which is exactly the set of features that make a registry valuable and also the set that makes its configuration surface larger. Each of those features has its own credentials and its own administrative toggle.

The measurement gap

The difference between 57,482 app matches and 136,248 title matches is a useful caution. A title match can catch documentation sites, mirrors and login pages that mention the product without being a registry that answers the fingerprint probe. Treat the larger number as a ceiling and the smaller as a floor.
Neither number identifies a registry with the default administrator credential still active. There is no fingerprint for a password that was never changed. That is precisely why the count matters less than the configuration check, and why an organisation's own inventory is the only source that can answer the question.

A review that fits in one session

Confirm the version first. Harbor's own release notes carry the security fixes, and a registry that has not been updated since installation is carrying more than a default password.
Log in as admin. If the credential is still Harbor12345, that is the finding, and it should be changed before any other work continues. If it has been changed, confirm who holds it and whether that person still needs it.
Then review the robot accounts. List each one, find the pipeline that uses it, and check its permission scope against what that pipeline actually does. A push-capable token held by a pipeline that only reads is a privilege that will be exercised someday by something else.
Check whether the registry is reachable from the internet at all. A registry that serves a fixed set of clusters does not need a public address, and the 136,248 title matches are a reminder of how many deployments have chosen otherwise.
Finally, confirm that content trust and scanning are enabled if the deployment relies on them. A registry that advertises scanning but has it disabled per project gives a false assurance that is worse than no assurance.

What this does and does not say

The counts describe indexed assets. They do not describe registries with default credentials, and nothing here suggests that 57,482 organisations left Harbor12345 in place. Most installations follow the documentation and change the password on day one.
The point is narrower and more durable. The default is documented, it is printed in the installation guide, and the mechanism that retires it depends on a human logging in and choosing a new value. Systems whose security depends on a first login deserve to be counted, and the ones that hand images to production deserve it twice.

References

Top comments (0)