{"schema":"threatline.record/2","record":{"id":"GHSA-2phj-cp9f-qq6w","aliases":["GHSA-2phj-cp9f-qq6w"],"summary":"SSRF in webhook delivery allows ProjectAdmin to reach internal services and cloud metadata endpoints","details":"### Impact\r\n\r\nA project administrator can configure a webhook (HTTP or Slack) that points at an address inside your network: localhost, private ranges (10/8, 172.16/12, 192.168/16), link-local, or the cloud metadata endpoint `169.254.169.254`. When an event fires, Harbor's jobservice sends an HTTP POST to that address from inside your deployment. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read.\r\n\r\nIn practice this lets a project admin reach services that are not meant to be reachable from outside, and read back parts of their error responses.\r\n\r\n### Am I affected?\r\n\r\nYou are affected if all of the following are true:\r\n\r\n- You run any Harbor version that supports webhooks (1.7.0 and later).\r\n- Users who are not fully trusted can become project admin. With the default setting **Project Creation: Everyone**, every registered user can create a project and is its admin.\r\n- jobservice has network access to internal services or a cloud metadata endpoint.\r\n\r\n### What to do\r\n\r\n**Upgrade** to Harbor v2.15.3, v2.14.5 or v2.13.6, or to v2.16.0 or later.\r\n\r\nAfter upgrading to v2.15.3, v2.14.5 or v2.13.6, webhooks to private, loopback and link-local addresses are rejected, and existing ones stop being delivered.\n\n> [!WARNING]\n> **v2.15.4 and v2.14.6 turn the address check off by default**\n>\n> v2.15.4 and v2.14.6 allow private, loopback, link-local and cloud metadata targets unless the setting below is `false`: `harbor.yml.tmpl` ships `network.allow_private_network_access: true`, and when `HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS` is not set (for example in Helm deployments) they are allowed as well. A `harbor.yml` that already sets `false` keeps that value. Redirects stay blocked and response bodies stay out of the execution log in every configuration.\n\nTo turn the address check on, unless you send webhooks to internal endpoints on purpose:\n\n- `harbor.yml` installs: `network.allow_private_network_access: false`, then re-run `prepare`\n- Helm or other deployments: the environment variable `HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS=false` on both core and jobservice (in the Helm chart: `core.extraEnvVars` and `jobservice.extraEnvVars`)\n\nIf you send webhooks to internal endpoints on purpose (for example an in-cluster CI system), set it to `true`. This turns the protection off, so only use it if you trust all of your project admins.\r\n\r\n**Until you can upgrade:**\r\n\r\n1. Set **Configuration > System Settings > Project Creation** to **Admin Only**, so untrusted users cannot become project admin.\r\n2. Restrict outbound traffic from the jobservice container or pod, for example with a Kubernetes NetworkPolicy or firewall rules, so it can only reach the webhook destinations you use. Block `169.254.169.254` in all cases.\r\n3. On cloud instances, require token-based metadata access (AWS IMDSv2, or the equivalent on your provider).\r\n\r\n### Check for misuse\r\n\r\nReview existing webhook targets for internal addresses:\r\n\r\n```sql\r\nSELECT id, project_id, name, creator, targets FROM notification_policy;\r\n```\r\n\r\nLook for targets using IP literals in private ranges, `localhost`, `169.254.169.254`, or internal service names. The webhook execution logs for these policies show what was sent and what came back.\r\n","categories":["Applications & CMS"],"product":"github.com/goharbor/harbor","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w","source_modified_at":"2026-10-26T14:58:10Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"go","name":"github.com/goharbor/harbor"},"range":">= 1.7.0, < 2.13.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w","source_modified_at":"2026-10-26T14:58:10Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"go","name":"github.com/goharbor/harbor"},"range":">= 2.14.0, < 2.14.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w","source_modified_at":"2026-10-26T14:58:10Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"go","name":"github.com/goharbor/harbor"},"range":">= 2.15.0, < 2.15.3"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w","source_modified_at":"2026-10-26T14:58:10Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"go","name":"github.com/goharbor/harbor"},"version":"2.13.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w","source_modified_at":"2026-10-26T14:58:10Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"go","name":"github.com/goharbor/harbor"},"version":"2.14.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w","source_modified_at":"2026-10-26T14:58:10Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"go","name":"github.com/goharbor/harbor"},"version":"2.15.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w","source_modified_at":"2026-10-26T14:58:10Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"go","name":"github.com/goharbor/harbor"},"version":"2.16.0"}],"cvss":8.5,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-06T12:21:19Z","modified_at":"2026-10-26T14:58:10Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-26T14:58:10Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-26T14:58:10Z","content_hash":"e0537a853d67a8cd4749c5576967d5489c2c06d5b580b787fe2a1a886df0d100"}}