Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Harbor | Harbor | affected |
|
||||||
| Harbor | Harbor | affected |
|
||||||
| Harbor | Harbor | affected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 26 Oct 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-601 |
Mon, 26 Oct 2026 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources. | |
| Title | SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: certcc
Published:
Updated: 2026-10-26T13:39:48.420Z
Reserved: 2026-10-16T13:26:28.566Z
Link: CVE-2026-111590
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-26T14:16:28.310
Modified: 2026-10-26T18:39:42.503
Link: CVE-2026-111590
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-26T15:30:15Z