{"action":"Upgrade github.com/goharbor/harbor to 2.13.5+incompatible or later.","affected":[{"fixed":"2.13.5+incompatible","introduced":"2.13.0+incompatible"},{"fixed":"2.14.3+incompatible","introduced":"2.14.0+incompatible"}],"component":"github.com/goharbor/harbor","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["2.13.5+incompatible","2.14.3+incompatible"],"ghsa_id":"GHSA-prh4-vhfh-24mj","id":"tcs_01M5KGGP0F4VE2D14FCRMXYQ5G","modified_at":"2026-04-02T21:20:01.386819Z","published_at":"2026-04-02T18:42:30Z","references":["https://osv.dev/vulnerability/GO-2026-4876","https://github.com/goharbor/harbor/security/advisories/GHSA-prh4-vhfh-24mj","https://github.com/goharbor/harbor/commit/85e756486fc19333c5c300d7ac273e1580dc9350"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4876","url":"https://osv.dev/vulnerability/GO-2026-4876"}],"summary":"Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor"}