# Harbor v2.15.3

> Storage & Data · 2026-10-06

A security-focused maintenance release with numerous vulnerability fixes, dependency updates, and defensive limits. It also includes routine correctness, logging, and dependency maintenance changes.

## Action needed
- **[security]** Path traversal in distribution endpoints
  - Harbor fixes a path traversal vulnerability in distribution endpoints, tracked as `GHSA-qj39-pjf2-wmrc`.
- **[security]** System robot administrator escalation
  - Harbor fixes an issue where a system robot with `user:update` could make itself a system administrator, tracked as `GHSA-w5fq-xrhj-j7g2`.
- **[security]** Robot cross-project takeover through global scope
  - Harbor fixes a flaw where the Robot "cover all projects" scope could become a global wildcard and grant `robot:update`, enabling cross-project robot takeover and owner lockout. The issue is tracked as `GHSA-xq2m-cj8w-56v5`.
- **[security]** Auth-proxy `admin` authorization inheritance
  - Harbor fixes an authorization flaw where an external auth-proxy identity named `admin` inherited Registry system-administrator authorization. The issue is tracked as `GHSA-xvh7-74g6-29xw`.
- **[security]** Immutable tag rule selector matching
  - Harbor fixes immutable tag rule matching so that all repository and tag selectors are evaluated instead of only the first. The issue is tracked as `GHSA-27f2-qg57-2gwg`.
- **[security]** Webhook delivery SSRF
  - Harbor fixes an SSRF issue in webhook delivery that could let a ProjectAdmin reach internal services and cloud metadata endpoints. The issue is tracked as `GHSA-2phj-cp9f-qq6w`.
- **[security]** Scanner bearer authorization request handling
  - Harbor fixes scanner bearer authorization requests that disabled TLS verification and read the full response body. The issue is tracked as `GHSA-884q-mjcg-86x4`.
- **[security]** Jobservice webhook response decompression
  - Harbor prevents webhook error responses from causing unbounded decompression in Jobservice. The issue is tracked as `GHSA-jw3v-7jvc-pfmx`.
- **[security]** Registry chunk upload `Location` headers
  - Harbor validates the `Location` headers reused during Registry chunk uploads. The issue is tracked as `GHSA-wjpm-hv5w-gxr6`.
- **[security]** Vulnerability and Content-Trust pull policy enforcement
  - Harbor fixes a bypass of vulnerability and Content-Trust pull policies caused by an attacker-controlled `User-Agent` header. The issue is tracked as `GHSA-wrw5-gmvj-gf23`.
- **[security]** Registry replication pagination `Link` handling
  - Harbor fixes SSRF and credential disclosure through an attacker-controlled pagination `Link` header in the Registry replication client. The issue is tracked as `GHSA-xgp2-5vxg-rgh2`.
- **[security]** Security middleware after `AuthMode` lookup failure
  - Harbor fixes security middleware behavior after an `AuthMode` lookup failure. The issue is tracked as `GHSA-3x7c-wf86-mjx6`.
- **[security]** Proxy-cache poisoning through robot-name prefixes
  - Harbor prevents proxy-cache poisoning through a robot-name prefix.
- **[security]** Go dependency updates for CVE fixes
  - Harbor upgrades Go dependencies to fix CVEs.
- **[breaking]** Manifest upload size limit
  - Harbor adds a size limit for manifest uploads.
- **[breaking]** Audit log payload size limit
  - Harbor adds a size limit for audit log payloads.

## Check if affected
- **[security]** `scanner_registration.access_cred` filtering
  - Applies if `scanner_registration.access_cred` is configured.
  - Harbor adds the missing `filter:"false"` handling for `scanner_registration.access_cred` to address the scanner credential disclosure issue. The issue is tracked as `GHSA-vwvv-675v-p6rr`.

## Other recorded changes
- 32 (value_changed 24, defect_corrected 6, constraint_changed 2)

[Full analysis](https://ratatosk.io/en/releases/harbor/v2.15.3)

[Original release notes](https://github.com/goharbor/harbor/releases/tag/v2.15.3)