---
id: CVE-2023-20902
aliases:
  - GHSA-mq6f-5xh5-hgcf
  - BIT-harbor-2023-20902
  - GO-2023-2109
title: Harbor timing attack risk
summary: Harbor timing attack risk
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: goharbor
product: github.com/goharbor/harbor
ecosystem: go
affected:
  - github.com/goharbor/harbor < 1.10.18
  - 'github.com/goharbor/harbor >= 2.0.0, < 2.7.3'
  - 'github.com/goharbor/harbor >= 2.8.0, < 2.8.3'
patched:
  - github.com/goharbor/harbor 1.10.18
  - github.com/goharbor/harbor 2.7.3
  - github.com/goharbor/harbor 2.8.3
published: '2023-10-10'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-mq6f-5xh5-hgcf'
references:
  - url: 'https://github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-20902'
  - url: 'https://github.com/goharbor/harbor'
  - url: >-
      https://github.com/goharbor/harbor/blob/aaea068cceb4063ab89313d9785f2b40f35b0d63/src/jobservice/api/authenticator.go#L69-L69
  - url: 'https://github.com/goharbor/harbor/releases/tag/v1.10.18'
  - url: 'https://github.com/goharbor/harbor/releases/tag/v2.7.3'
  - url: 'https://github.com/goharbor/harbor/releases/tag/v2.8.3'
tags:
  - osv
  - go
epss: 0.00373
epssPercentile: 0.31244
ingestedAt: '2026-07-09T18:56:36.649Z'
---

## Overview

In the Harbor jobservice container, the comparison of secrets in the authenticator type is prone to timing attacks. The vulnerability occurs due to the following code: https://github.com/goharbor/harbor/blob/aaea068cceb4063ab89313d9785f2b40f35b0d63/src/jobservice/api/authenticator.go#L69-L69
To avoid this issue, constant time comparison should be used.
```
subtle.ConstantTimeCompare([]byte(expectedSecret), []byte(secret)) == 0
```

### Impact
This attack might be possible theoretically, but no workable proof of concept is available, and access complexity is set at High.
The jobservice exposes these APIs
```
Create a job task --- POST /api/v1/jobs    
Get job task information --- GET /api/v1/jobs/{job_id}
Stop job task ---  POST /api/v1/jobs/{job_id}
Get job log task ---  GET /api/v1/jobs/{job_id}/log
Get job execution --- GET /api/v1/jobs/{job_id}/executions
Get job stats ---  GET /api/v1/stats
Get job service configuration ---  GET /api/v1/config
```
It is used to create jobs/stop job tasks and retrieve job task information.  If an attacker obtains the secrets, it is possible to retrieve the job information, create a job, or stop a job task. 

The following versions of Harbor are involved:
<=Harbor 2.8.2, <=Harbor 2.7.2, <= Harbor 2.6.x, <=Harbor 1.10.17


### Patches
Harbor 2.8.3, Harbor 2.7.3, Harbor 1.10.18

### Workarounds
Because the jobservice only exposes HTTP service to harbor-core containers, blocking any inbound traffic from the external network to the jobservice container can reduce the risk.

### Credits
Thanks to Porcupiney Hairs for reporting this issue.


## Affected packages

- `github.com/goharbor/harbor < 1.10.18`
- `github.com/goharbor/harbor >= 2.0.0, < 2.7.3`
- `github.com/goharbor/harbor >= 2.8.0, < 2.8.3`

## Remediation

Upgrade to a patched release:

- `github.com/goharbor/harbor 1.10.18`
- `github.com/goharbor/harbor 2.7.3`
- `github.com/goharbor/harbor 2.8.3`