Harbor

securityPath traversal in distribution endpoints

Harbor fixes a path traversal vulnerability in distribution endpoints, tracked as GHSA-qj39-pjf2-wmrc.

securitySystem robot administrator escalation

Harbor fixes an issue where a system robot with user:update could make itself a system administrator, tracked as GHSA-w5fq-xrhj-j7g2.

securityRobot cross-project takeover through global scope

Harbor fixes a flaw where the Robot "cover all projects" scope could become a global wildcard and grant robot:update, enabling cross-project robot takeover and owner lockout. The issue is tracked as GHSA-xq2m-cj8w-56v5.

securityAuth-proxy admin authorization inheritance

Harbor fixes an authorization flaw where an external auth-proxy identity named admin inherited Registry system-administrator authorization. The issue is tracked as GHSA-xvh7-74g6-29xw.

securityImmutable tag rule selector matching

Harbor fixes immutable tag rule matching so that all repository and tag selectors are evaluated instead of only the first. The issue is tracked as GHSA-27f2-qg57-2gwg.

securityWebhook delivery SSRF

Harbor fixes an SSRF issue in webhook delivery that could let a ProjectAdmin reach internal services and cloud metadata endpoints. The issue is tracked as GHSA-2phj-cp9f-qq6w.

securityScanner bearer authorization request handling

Harbor fixes scanner bearer authorization requests that disabled TLS verification and read the full response body. The issue is tracked as GHSA-884q-mjcg-86x4.

securityJobservice webhook response decompression

Harbor prevents webhook error responses from causing unbounded decompression in Jobservice. The issue is tracked as GHSA-jw3v-7jvc-pfmx.

securityRegistry chunk upload Location headers

Harbor validates the Location headers reused during Registry chunk uploads. The issue is tracked as GHSA-wjpm-hv5w-gxr6.

securityVulnerability and Content-Trust pull policy enforcement

Harbor fixes a bypass of vulnerability and Content-Trust pull policies caused by an attacker-controlled User-Agent header. The issue is tracked as GHSA-wrw5-gmvj-gf23.

securityRegistry replication pagination Link handling

Harbor fixes SSRF and credential disclosure through an attacker-controlled pagination Link header in the Registry replication client. The issue is tracked as GHSA-xgp2-5vxg-rgh2.

securitySecurity middleware after AuthMode lookup failure

Harbor fixes security middleware behavior after an AuthMode lookup failure. The issue is tracked as GHSA-3x7c-wf86-mjx6.

securityProxy-cache poisoning through robot-name prefixes

Harbor prevents proxy-cache poisoning through a robot-name prefix.

securityGo dependency updates for CVE fixes

Harbor upgrades Go dependencies to fix CVEs.

breakingManifest upload size limit

Harbor adds a size limit for manifest uploads.

breakingAudit log payload size limit

Harbor adds a size limit for audit log payloads.