CVE-2026-111590
Received Received - Intake

SSRF Vulnerability in Harbor via Unvalidated Webhook Targets

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: CERT/CC

Description
A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-111590
EUVD
EUVD-2026-109830

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Harbor Harbor 2.15.0
Harbor Harbor 2.14.0
Harbor Harbor 1.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111590 is a Server-Side Request Forgery (SSRF) vulnerability in Harbor, a cloud-native container registry. It allows a ProjectAdmin user to configure webhooks pointing to internal services, private network ranges, link-local addresses, or cloud metadata endpoints. When triggered, Harbor's jobservice sends an HTTP POST request to the specified address. If the target responds with an error, the response body is logged and accessible to project members, potentially exposing sensitive internal service details.

Detection Guidance

Check Harbor webhook execution logs for outbound requests to private or link-local IP ranges. Review webhook configurations in Harbor UI/API for targets pointing to internal services or cloud metadata endpoints like 169.254.169.254. Use network monitoring tools to detect unauthorized outbound connections from Harbor's jobservice container.

Impact Analysis

An attacker with ProjectAdmin permissions could access internal network resources, cloud metadata, or other restricted services. Sensitive data like service configurations or cloud provider metadata may be exposed through webhook execution logs. The impact includes potential data breaches, unauthorized access to internal systems, and exposure of confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Exposure of internal resources or cloud metadata may result in non-compliance with these regulations, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Upgrade Harbor to patched versions (2.13.6, 2.14.5, 2.15.3, or 2.16.0+). Block outbound traffic from jobservice to private/link-local/cloud metadata addresses. Restrict Project Creation to Admin Only. Review and remove existing webhook targets pointing to internal services. Enable address blocking in Harbor configurations if using versions 2.15.4 or 2.14.6.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111590. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart