The vulnerability allows a holder of ProjectAdmin rights to configure a webhook that points to private network addresses. When an event triggers, Harbor’s jobservice sends an unauthenticated HTTP POST to the specified address. If the target responds with an error, the response body is logged and can be viewed by project members. This can expose cloud metadata or other internal resources that are normally network–restricted, leading to potential information leakage.

Harbor registry deployments across all current releases are susceptible. The weakness exists in the webhook delivery component where target URLs are not validated for private or link‑local addresses. No specific versions are enumerated, so any Harbor instance running a affected build may be impacted.

Because the attacker only needs ProjectAdmin privileges, the risk is sizable for any Harbor environment that allows project administrators. The exploitation requires no external network access from the attacker; all traffic originates from Harbor’s jobservice. No CVSS score is provided, and EPSS is unavailable, but the potential to retrieve sensitive internal data makes this a high‑consequence issue. The vulnerability is currently not listed in the CISA KEV catalog.