Read the docs
TI-2026-80367 Aliases CVE-2026-111590GHSA-h7v4-fjg7-95fc

Server-side request forgery in Harbor webhook delivery

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

Harbor versions from 1.7.0 before 2.13.6, from 2.14.0 before 2.14.5 and from 2.15.0 before 2.15.3 are affected. Webhook targets are not properly validated, so private and link-local IP ranges are accepted. An authenticated ProjectAdmin can point a webhook at an internal address, and Harbor jobservice then sends unauthenticated POST requests there. Error response bodies land in a webhook log that project members can read, potentially exposing cloud metadata.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources.

Why it matters now

EPSS 0.00213 11th percentileScored 2026-11-07
Fix Fixed Harbor (Harbor): 2.15.3, 2.14.5, 2.13.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstageHarbor2.15.0 to before 2.15.32.15.3Patch availableCNA
backstageHarbor2.14.0 to before 2.14.52.14.5Patch availableCNA
backstageHarbor1.7.0 to before 2.13.62.13.6Patch availableCNA
  • Harbor Vendorbackstage Affected 2.15.0 to before 2.15.3 Fixed in 2.15.3 Patch available CNA
  • Harbor Vendorbackstage Affected 2.14.0 to before 2.14.5 Fixed in 2.14.5 Patch available CNA
  • Harbor Vendorbackstage Affected 1.7.0 to before 2.13.6 Fixed in 2.13.6 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*——backstage
  • cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:* Versions — — ·backstage

Remediation

Upgrade Harbor to version 2.13.6, 2.14.5 or 2.15.3, matching your release line.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Harbor (Harbor) Fixed in 2.15.3
  • Fix · CNA Harbor (Harbor) Fixed in 2.14.5
  • Fix · CNA Harbor (Harbor) Fixed in 2.13.6

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-111590
  2. 2026-10-27 Alias added: GHSA-h7v4-fjg7-95fc

References

Other 1

  • TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
  • TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
  • TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
  • TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
  • TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
See all 662 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences