Harbor 2.0
Harbor 2.0
The Harbor 2.0 reached end of service life on Jun 17, 2021 — Harbor no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Harbor 2.0 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- harbor
- release
- 2.0
- product Label
- Harbor
- release Label
- 2.0
- codename
- lts
- latest Version
- 2.0.6
- release Date
- 2020-05-13
- maintained
- source Url
- https://endoflife.date/harbor
Lifecycle Dates
- End of Service Life
- Jun 17, 2021
- Last OEM Support
- Jun 17, 2021
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Harbor 2.0 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Harbor 2.0?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Harbor 2.0 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Harbor 2.0 Support: Frequently Asked Questions
Is the Harbor 2.0 still supported?
Harbor ended support for the Harbor 2.0 on Jun 17, 2021 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Harbor 2.0 end of service life (EOSL) date?
Harbor lists the end of service life for the Harbor 2.0 as Jun 17, 2021.
Can I keep using the Harbor 2.0 after its EOSL date?
Yes. EOSL means Harbor stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Harbor 2.0 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Harbor 2.0
13 published CVEs affect the Harbor 2.0, including 6 rated critical or high severity. Harbor no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-4404 | CRITICAL | 9.4 | Mar 23, 2026 | Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI. |
| CVE-2022-31670 | HIGH | 7.7 | Nov 14, 2024 | Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag retention policies configured in other projects. |
| CVE-2022-31666 | HIGH | 7.7 | Nov 14, 2024 | Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects. |
| CVE-2022-46463 | HIGH | 7.5 | Jan 13, 2023 | An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature." |
| CVE-2022-31671 | HIGH | 7.4 | Nov 14, 2024 | Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database. |
| CVE-2022-31668 | HIGH | 7.4 | Nov 14, 2024 | Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects. |
| CVE-2022-31669 | MEDIUM | 6.4 | Nov 14, 2024 | Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag immutability policies configured in other projects. |
| CVE-2022-31667 | MEDIUM | 6.4 | Nov 14, 2024 | Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions. |
| CVE-2024-22278 | MEDIUM | 6.4 | Aug 2, 2024 | Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations. |
| CVE-2019-19030 | MEDIUM | 5.3 | Dec 26, 2022 | Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists. |
| CVE-2020-29662 | MEDIUM | 5.3 | Feb 2, 2021 | In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path. |
| CVE-2020-13794 | MEDIUM | 4.3 | Sep 30, 2020 | Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor. |
| CVE-2020-13788 | MEDIUM | 4.3 | Jul 15, 2020 | Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet. |