Is there a patch available for CVE-2026-111590?

Yes, a patch is available for CVE-2026-111590. Update the affected software to the latest version immediately.

Harbor CVE-2026-111590

EUVD-2026-109830

2026-10-26 certcc

GHSA-h7v4-fjg7-95fc

SSRF Harbor

View

Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources.

Affected VersionsENISA

Harbor 2.14.0 <2.14.5

Harbor 2.15.0 <2.15.3

Harbor 1.7.0 <2.13.6

Affected Packages

euvd harbor fix: 2.13.6, 2.14.5, 2.15.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Harbor gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 26, 2026 - 15:17 EUVD

CVE Published

Oct 26, 2026 - 13:39 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Data Quality

2 sources

Confidence: Low

EUVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

More in Harbor

View all

CVE-2017-17697 HIGH This Week POC

8.6 Dec 15

The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/

CVE-2026-92770 HIGH This Week POC

7.1 Sep 16

Harbor through 2.15.2 can disclose scanner adapter AccessCredential secrets to an authenticated project administrator wh

CVE-2023-20902 MEDIUM This Month POC

6.5 Nov 09

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and bel

CVE-2019-16097 MEDIUM This Month POC

6.5 Sep 08

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users A

CVE-2026-4404 CRITICAL Act Now

9.4 Mar 23

GoHarbor Harbor versions 2.15.0 and earlier contain hardcoded default credentials that allow unauthenticated attackers t

CVE-2020-13794 MEDIUM This Month POC

4.3 Sep 30

Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor. Rated medium severity (

CVE-2020-13788 MEDIUM This Month POC

4.3 Jul 15

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of

CVE-2019-16919 HIGH This Week

7.5 Oct 18

Harbor API has a Broken Access Control vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exp

CVE-2024-22244 MEDIUM This Month

6.1 Jun 10

Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site. Rated medium severity

CVE-2024-22261 MEDIUM This Month

5.5 Jun 11

SQL-Injection in Harbor allows priviledge users to leak the task IDs. Rated medium severity (CVSS 5.5), this vulnerabili

CVE-2024-22278 MEDIUM This Month

4.3 Aug 02

Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configur

CVE-2019-3990 MEDIUM This Month

4.3 Dec 03

A User Enumeration flaw exists in Harbor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable,

Same technique SSRF

View all

CVE-2021-34473 CRITICAL POC

9.1

CVE-2021-26855 CRITICAL POC

9.1

CVE-2021-21985 CRITICAL POC

9.8

CVE-2024-21893 HIGH POC

8.2

CVE-2021-40438 CRITICAL POC

9.0

CVE-2021-22054 HIGH POC

7.5

CVE-2021-21975 HIGH POC

7.5

CVE-2016-3718 MEDIUM POC

5.5

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-111590 REF https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back