Harbor contains hard‑coded default administrator credentials that are deployed unchanged when the product is installed. An attacker who can reach the web interface can use the username admin and the password Harbor12345 to authenticate as an administrator, gaining full control over the registry, including the capability to upload, delete, or modify container images and to alter configuration settings.

The flaw affects Harbor 2.15.0 and all earlier releases. Any deployment that has not been updated beyond 2.15.0 and that has not configured a custom administrator password is at risk. This includes installations of Harbor deployed from the open‑source project or from Harbor Inc.; the vulnerability is product‑wide regardless of hosting environment.

The CVSS score of 9.4 classifies the issue as critical. The exploit requires only network access to the Harbor UI and no special configuration or privilege escalation. The absence of a KEV listing does not reduce the risk, as the credentials are trivial to guess and the vulnerability is well documented. An attacker who gains administrative access can compromise the integrity and confidentiality of all container artifacts in the registry.