Harbor GHSA-2phj-cp9f-qq6w (CVSS 8.5): ProjectAdmin webhook SSRF can hit internal services and cloud metadata (169.254.169.254); error bodies land in webhook logs — patch to 2.13.6 / 2.14.5 / 2.15.3 / 2.16.0+

The Harbor project published GitHub security advisory GHSA-2phj-cp9f-qq6w on 6 October 2026 (no CVE assigned): a project administrator can point an HTTP or Slack webhook at localhost, private ranges, link-local, or the cloud metadata endpoint 169.254.169.254. When an event fires, Harbor jobservice POSTs from inside the deployment; if the target returns an error status, the response body is written to the webhook execution log readable by project members — so a ProjectAdmin can reach internal services and skim error responses (including metadata-style leaks). CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). Affected: Harbor with webhooks from 1.7.0 onward when untrusted users can become project admin (default Project Creation: Everyone makes every registered user a project admin of projects they create) and jobservice can reach internals. Fixed in 2.13.6, 2.14.5, 2.15.3 and 2.16.0+, which reject private/loopback/link-local webhook targets unless HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS / network.allow_private_network_access is deliberately re-enabled. Until then: set Project Creation to Admin Only, restrict jobservice egress, block 169.254.169.254, prefer IMDSv2. Wire: The Hacker News ThreatsDay (16 Oct) via OX Security. Primary: Harbor GHSA.

Product

Harbor (CNCF container registry) — webhook / jobservice

Versions

Vulnerable: >= 1.7.0, < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3. Patched: 2.13.6, 2.14.5, 2.15.3, 2.16.0+

CVSS

8.5 (CVSS 3.1, GitHub)

Exploited in Australia?

unknown

Patch to

Upgrade Harbor to 2.13.6, 2.14.5, 2.15.3 or 2.16.0+. After upgrade, audit notification_policy webhook targets for private IPs, localhost and 169.254.169.254. Until you can patch: set Project Creation to Admin Only, NetworkPolicy/firewall jobservice egress away from metadata and internals, enforce cloud metadata tokens (IMDSv2).

Primary: Harbor GHSA-2phj-cp9f-qq6w — SSRF in webhook delivery (6 Oct 2026) · Vendor: Harbor project · The Hacker News — ThreatsDay bulletin notes Harbor webhook SSRF / cloud credential theft path (16 Oct 2026)

tech cloud