Harbor v2.15.10

Released 2026-10-06.

Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published.

Summary

#988 Fixes the OpenAPI spec, Harbor now advertises https only and no longer names http://localhost as an API endpoint.

Security Advisories

• high: Path traversal vulnerability in distribution endpoints (GHSA-qj39-pjf2-wmrc) (a82c5528f)
• high: A system robot with user:update makes itself a system administrator (GHSA-w5fq-xrhj-j7g2) (8896be0ae)
• high: Robot “cover all projects” scope collapses into a global wildcard, conferring the deliberately-ungrantable robot:update — enabling cross-project robot takeover with owner lockout (GHSA-xq2m-cj8w-56v5) (7331b58d5)
• high: External auth-proxy identity named admin inherits Registry system-administrator authorization (GHSA-xvh7-74g6-29xw) (13e5a1b97)
• medium: Immutable tag rule matcher only evaluates first repository/tag selector, allowing multi-selector rules to be bypassed (GHSA-27f2-qg57-2gwg) (08c58f3c7)
• medium: SSRF in webhook delivery allows ProjectAdmin to reach internal services and cloud metadata endpoints (GHSA-2phj-cp9f-qq6w) (fb476e10c)
• medium: Scanner bearer authorization request disables TLS verification and reads the full response body (GHSA-884q-mjcg-86x4) (eb1a6fb64)
• medium: Webhook error responses can cause unbounded decompression in Jobservice (GHSA-jw3v-7jvc-pfmx) (fb476e10c)
• medium: scanner_registration.access_cred is missing filter:“false”, giving a project admin a blind oracle over the scanner credential (GHSA-vwvv-675v-p6rr) (d2e2312f5)
• medium: Registry chunk upload reuses unvalidated Location headers (GHSA-wjpm-hv5w-gxr6) (401e73429)
• medium: Vulnerability & Content-Trust pull policies bypassable via attacker-controlled User-Agent header (GHSA-wrw5-gmvj-gf23) (9d255ebe1)
• medium: SSRF and credential disclosure via attacker-controlled pagination Link header in the registry replication client (GHSA-xgp2-5vxg-rgh2) (a01e0c6c5)
• low: Security middleware continues after AuthMode lookup failure (GHSA-3x7c-wf86-mjx6) (bfd319a92)

Fixes

• api: Advertise only https in the OpenAPI spec (#1097)
• api: Bound Audited And Manifest Request Bodies (backport #1138) (#1170)
• api: Use valid OpenAPI 2.0 numeric format values (#1098)
• authproxy: Clear Leaked Local Sysadmin Flag In The http_auth /v2 Context (backport #1128) (#1149)
• Constrain Pagination Link Next URL To The Request Origin (backport #1134) (#1157)
• core: Serve the API docs page only when it is enabled (#1096)
• core: Set Secure and SameSite on the session cookie (#1102)
• db: Resolve the execution table through search_path in the revision guard (backport #929) (#933)
• deps: Bump OpenTelemetry To v1.46.0 (#1114)
• gc: Use the current registry Redis URL for scheduled runs (#1053)
• immutable: Evaluate All Repository And Tag Selectors (backport #1139) (#1163)
• jobservice: Unschedule periodic policy by ID instead of score (#1055)
• Keep the HTTPS port in the portal redirect and healthcheck (#1064)
• member: Require Project-Admin Authority To Grant The Project-Admin Role (backport #1137) (#1159)
• Open the request transaction after the middlewares that read the DB (#1058)
• orm: Detach AfterCommit hooks from a cloned or copied context (#1104)
• policy: Stop User-Agent From Bypassing Content-Trust And Vulnerability Policies (backport #1130) (#1155)
• portal: Line Up the Authentication Tab Controls (#1082)
• quota: Refresh usage before enforcing a changed hard limit (backport #1123) (#1153)
• rbac: Stop Cover-All Robot Scope From Reaching Sub-Resources (backport #1127) (#1148)
• registry: Reject Dot Segments In /v2/ Distribution Paths (backport #1136) (#1160)
• registry: Validate Chunk-Upload Location Against The Registry Origin (backport #1133) (#1156)
• Require Sysadmin Identity For Grants (backport #1135) (#1158)
• Resolve audit and auth lookups on the request’s own DB connection (#1099)
• retention: Require Durable Deletion Authority (backport #1164) (#1171)
• scanner: Stop Filtering Scanner Registrations By access_cred (backport #1129) (#1150)
• scan: Verify TLS And Bound Body On Scanner Bearer Token Request (backport #1131) (#1151)
• scheduler: Ignore randomized seconds when comparing cron (#1054)
• security: Fail Closed When Auth Mode Lookup Fails (backport #1132) (#1152)
• Send Cache-Control no-store On API And Static JSON Responses (#1111)
• Send Referrer-Policy And Permissions-Policy From Portal And Core (#1112)
• Send X-Content-Type-Options nosniff From Portal And Core (#1110)
• Send X-Frame-Options And CSP frame-ancestors From Portal And Core (#1109)
• Serve user settings from memory, synced by Postgres change notifications (#1057)
• Stop Scan All holding a pool connection per artifact (#1100)
• webhook: Block Private-Network Targets And Stop Reflecting Response Bodies (backport #1140) (#1172)

Updates

• quota: Coalesce per-request refresh through the deferred flush (backport #719) (#1126)
• quota: Skip usage reservation when hard limits are unlimited (backport #734) (#1120)
• Skip request-wide DB transaction for POST initiate blob upload (#1059)

Upstream

• gc: do not count blobs missing from storage as freed space (goharbor/harbor#23972) (3188dc5)
• repoproxy: query robot account to validate proxy session and fix unit tests (goharbor/harbor#23776) (aa33a5a)
• refactor(p2p): Redact credentials in HTTP client logging (goharbor/harbor#23873) (dcd74b7)
• Refine utils function IsLocalPath (goharbor/harbor#23756) (9be4af4)
• Remove hardcoded credentials and prevent passwords in logs (goharbor/harbor#23835) (61cbc87)
• Sanitize connection details in logs (goharbor/harbor#23878) (c4e3a96)

Container Images

Multi-arch images (linux/amd64, linux/arm64) signed with cosign.

Verify an image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.10