CVE-2026-111590 Harbor CVE debrief

Who should care

Defenders responsible for Harbor deployments, especially those with ProjectAdmin permissions, should assess their exposure and take necessary actions to prevent SSRF attacks. This includes verifying Harbor deployment versions and configurations, restricting webhook policy configurations, and monitoring webhook execution logs. Additionally, defenders should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

This vulnerability allows an authenticated attacker with ProjectAdmin permissions to configure a webhook policy pointing to a private internal address, potentially exposing cloud metadata or other network-restricted resources. Defenders should prioritize verifying exposure and assessing the impact on their Harbor deployments.

• Potential exposure of cloud metadata or other network-restricted resources
• Possible unauthorized access to internal services
• Need for verification of affected versions and configurations
• Requirement for monitoring webhook execution logs

Technical summary

The vulnerability is caused by the lack of proper validation of webhook target addresses in Harbor's webhook delivery component. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address, allowing them to reach internal services. This could potentially expose cloud metadata or other network-restricted resources. The vulnerability affects Harbor versions 1.7.0 to 2.15.0, and defenders should prioritize verifying exposure and assessing the impact on their Harbor deployments.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their Harbor deployments, especially for versions 1.7.0 to 2.15.0.

Recommended defensive actions

• Verify Harbor deployment versions and configurations to assess exposure
• Restrict webhook policy configurations to prevent SSRF attacks
• Monitor webhook execution logs for potential exposure of sensitive information
• Update Harbor to a version that addresses this vulnerability, if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but the impact and remediation require verification from official sources. Affected Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.