CVE-2026-111590

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-111590

A wide range of Harbor versions are vulnerable to Server-Side Request Forgery (SSRF) due to a lack of validation on webhook target addresses. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy targeting private or link-local IP ranges. When a project event trig...

EUVD-2026-109830

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...