CVE-2026-111590 in Harbor
Summary
by MITRE • 10/26/2026
A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in various versions of Harbor constitutes a Server-Side Request Forgery (SSRF) flaw located within its webhook delivery subsystem. This security defect arises from insufficient validation mechanisms applied to the target addresses configured for webhook policies. Specifically, the system fails to restrict or sanitize input that directs outbound requests toward private IP ranges and link-local addresses, which are typically inaccessible from external networks but represent critical internal infrastructure components. The root cause lies in the lack of rigorous address filtering during the configuration phase, allowing an authenticated user with ProjectAdmin permissions to define webhook endpoints pointing inward rather than outward to legitimate external services.
From a technical perspective, when a project event triggers within Harbor, the jobservice component initiates unauthenticated outbound HTTP POST requests to the specified target URL. Because these requests originate from the server itself, they bypass network perimeter defenses that might otherwise block such traffic if it were initiated externally. The critical exploitation vector occurs in how Harbor handles error responses from these internal targets. If the targeted internal service returns an HTTP error status code, Harbor writes the entire response body into the webhook execution log. This logging mechanism serves as a data exfiltration channel, effectively turning the server's own diagnostic tools into a proxy for reading sensitive information hosted on internal services that would otherwise be protected from direct external access.
The operational impact of this vulnerability is significant, particularly in environments where Harbor manages container images and artifacts within complex cloud or hybrid infrastructure setups. An attacker with ProjectAdmin privileges can leverage this flaw to perform reconnaissance against the internal network topology by probing various private IP ranges and ports. More critically, they can extract sensitive data from services that expose metadata endpoints, such as those found on Amazon EC2 instances (e.g., http://169.254.169.254/latest/meta-data/), or access other internal APIs like Kubernetes API servers, database management interfaces, or configuration management tools. The exposure of cloud metadata can lead to the compromise of instance credentials and further lateral movement within the environment. Additionally, reading response bodies from error states allows attackers to gather detailed information about internal service versions, configurations, and potential secondary vulnerabilities based on stack traces or debug output returned by these services.
This vulnerability aligns with CWE-918, which classifies Server-Side Request Forgery (SSRF) flaws where a web server constructs a request from user-supplied data without proper validation of the destination address. Furthermore, in terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Tool Transfer scenarios involving SSRF for network discovery and credential theft. The ability to read response bodies via log files also relates to CWE-209, which involves the exposure of an error message that reveals sensitive information.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Harbor administrators must upgrade to a patched version where strict IP address validation is enforced for webhook targets, explicitly blocking private RFC1918 ranges, link-local addresses (such as 169.254.x.x), and loopback interfaces. For environments running unpatched versions, restricting ProjectAdmin permissions to only those users who absolutely require them can reduce the attack surface by limiting the number of individuals capable of configuring webhook policies. Additionally, implementing network-level controls such as egress filtering on Harbor hosts can prevent outbound connections to private IP ranges regardless of application-layer configurations. It is also advisable to review and sanitize log outputs to ensure that sensitive data from internal services is not inadvertently written to logs accessible by project members, thereby closing the information disclosure channel even if an SSRF attempt succeeds.