CVE-2026-111590— SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

Quick assessment

Affected

Harbor Harbor

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

广泛版本的 Harbor 在其 webhook 交付组件中存在 SSRF 漏洞：该组件未对 webhook 目标地址进行充分校验，导致攻击者可使用私有地址和链路本地（link-local）IP 段。拥有 ProjectAdmin 权限的认证攻击者可以配置一条指向内部私有地址的 webhook 策略。当项目事件触发时，Harbor 的 jobservice 组件会向目标地址发起无认证的出站 HTTP POST 请求。如果目标返回错误状态码，其响应体将被写入 webhook 执行日志，而该日志对项目成员可见，从而可能泄

AI Predicted 8.8 Difficulty: Easy EPSS 0.21% · P12 Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1069 · Permission Groups Discovery T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

Vendor	Product	Version Range	Status
Harbor	Harbor	`2.15.0< 2.15.3`	affected
		`2.14.0< 2.14.5`	affected
		`1.7.0< 2.13.6`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

Source: CVE Program / CVE List V5

Vulnerability Description

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Harbor	Harbor	2.15.0 ~ 2.15.3	-
Harbor	Harbor	2.14.0 ~ 2.14.5	-
Harbor	Harbor	1.7.0 ~ 2.13.6	-

II. Public POCs for CVE-2026-111590

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111590

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-111590 (1)

🔗 SSRF in webhook delivery allows ProjectAdmin to reach internal services and cloud metadata endpoints · Advisory · goharbor/harbor · GitHub

https://www.cve.org/CVERecord?id=CVE-2026-111590

IV. Related Vulnerabilities

Same product: Harbor

Same vendor: Harbor