Harbor 1.9
Harbor 1.9
The Harbor 1.9 reached end of service life on Sep 18, 2020 — Harbor no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Harbor 1.9 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- harbor
- release
- 1.9
- product Label
- Harbor
- release Label
- 1.9
- codename
- lts
- latest Version
- 1.9.4
- release Date
- 2019-09-17
- maintained
- source Url
- https://endoflife.date/harbor
Lifecycle Dates
- End of Service Life
- Sep 18, 2020
- Last OEM Support
- Sep 18, 2020
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Harbor 1.9 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Harbor 1.9?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Harbor 1.9 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Harbor 1.9 Support: Frequently Asked Questions
Is the Harbor 1.9 still supported?
Harbor ended support for the Harbor 1.9 on Sep 18, 2020 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Harbor 1.9 end of service life (EOSL) date?
Harbor lists the end of service life for the Harbor 1.9 as Sep 18, 2020.
Can I keep using the Harbor 1.9 after its EOSL date?
Yes. EOSL means Harbor stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Harbor 1.9 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Harbor 1.9
15 published CVEs affect the Harbor 1.9, including 7 rated critical or high severity. Harbor no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-4404 | CRITICAL | 9.4 | Mar 23, 2026 | Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI. |
| CVE-2019-19025 | HIGH | 8.8 | Mar 20, 2020 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform. |
| CVE-2019-19023 | HIGH | 8.8 | Mar 20, 2020 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform. |
| CVE-2022-31670 | HIGH | 7.7 | Nov 14, 2024 | Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag retention policies configured in other projects. |
| CVE-2022-46463 | HIGH | 7.5 | Jan 13, 2023 | An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature." |
| CVE-2019-16919 | HIGH | 7.5 | Oct 18, 2019 | Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account. |
| CVE-2019-19029 | HIGH | 7.2 | Mar 20, 2020 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform. |
| CVE-2019-16097 | MEDIUM | 6.5 | Sep 8, 2019 | core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP. |
| CVE-2024-22278 | MEDIUM | 6.4 | Aug 2, 2024 | Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations. |
| CVE-2023-20902 | MEDIUM | 5.9 | Nov 9, 2023 | A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information. |
| CVE-2019-19030 | MEDIUM | 5.3 | Dec 26, 2022 | Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists. |
| CVE-2019-19026 | MEDIUM | 4.9 | Mar 20, 2020 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform. |
| CVE-2020-13794 | MEDIUM | 4.3 | Sep 30, 2020 | Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor. |
| CVE-2020-13788 | MEDIUM | 4.3 | Jul 15, 2020 | Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet. |
| CVE-2019-3990 | MEDIUM | 4.3 | Dec 3, 2019 | A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality. |