Harbor CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Harbor CVE published 2026-10-26

CVE-2026-111590

A vulnerability in Harbor's webhook delivery component allows an authenticated attacker with ProjectAdmin permissions to configure a webhook policy pointing to a private internal address. This could potentially expose cloud metadata or other network-restricted resources. The vulnerability arises from the lack of proper validation of webhook target addresses, enabling attackers to reach internal services. [truncated]