--- title: "Harbor v2.15.10" description: "Release notes for Container Registry 2.15.10: fixes for thirteen upstream security advisories, browser security headers, and webhook and registry SSRF guards." date: 2026-10-20 lastmod: 2026-10-20 canonical: "https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.10/" source: "https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.10/index.md" harbor_version: "2.15" agent_instructions: "This is the markdown representation of https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.10/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt." --- > Agent-friendly representation of . Site index: . # Harbor v2.15.10 *Release notes for Container Registry 2.15.10: fixes for thirteen upstream security advisories, browser security headers, and webhook and registry SSRF guards.* Harbor v2.15.10 =============== Released 2026-10-06. Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published. ## Summary [#988](https://github.com/container-registry/harbor-next/issues/988) Fixes the OpenAPI spec, Harbor now advertises `https` only and no longer names `http://localhost` as an API endpoint. ## Security Advisories - **high:** Path traversal vulnerability in distribution endpoints ([GHSA-qj39-pjf2-wmrc](https://github.com/goharbor/harbor/security/advisories/GHSA-qj39-pjf2-wmrc)) ([a82c5528f](https://github.com/goharbor/harbor/commit/a82c5528f1e939a78f2ce9acab9ecd03ee90b98f)) - **high:** A system robot with user:update makes itself a system administrator ([GHSA-w5fq-xrhj-j7g2](https://github.com/goharbor/harbor/security/advisories/GHSA-w5fq-xrhj-j7g2)) ([8896be0ae](https://github.com/goharbor/harbor/commit/8896be0aed0dbbd2b59d1524b748b4699e823c39)) - **high:** Robot "cover all projects" scope collapses into a global wildcard, conferring the deliberately-ungrantable robot:update — enabling cross-project robot takeover with owner lockout ([GHSA-xq2m-cj8w-56v5](https://github.com/goharbor/harbor/security/advisories/GHSA-xq2m-cj8w-56v5)) ([7331b58d5](https://github.com/goharbor/harbor/commit/7331b58d594f245aaf7f70515473aedffff85499)) - **high:** External auth-proxy identity named admin inherits Registry system-administrator authorization ([GHSA-xvh7-74g6-29xw](https://github.com/goharbor/harbor/security/advisories/GHSA-xvh7-74g6-29xw)) ([13e5a1b97](https://github.com/goharbor/harbor/commit/13e5a1b979d90d346716c19eefc5f6cfa31dce0e)) - **medium:** Immutable tag rule matcher only evaluates first repository/tag selector, allowing multi-selector rules to be bypassed ([GHSA-27f2-qg57-2gwg](https://github.com/goharbor/harbor/security/advisories/GHSA-27f2-qg57-2gwg)) ([08c58f3c7](https://github.com/goharbor/harbor/commit/08c58f3c76bd8e9252996a3cc62dade10d4e3ab4)) - **medium:** SSRF in webhook delivery allows ProjectAdmin to reach internal services and cloud metadata endpoints ([GHSA-2phj-cp9f-qq6w](https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w)) ([fb476e10c](https://github.com/goharbor/harbor/commit/fb476e10c9f981bd994011563bef6c5292ec272c)) - **medium:** Scanner bearer authorization request disables TLS verification and reads the full response body ([GHSA-884q-mjcg-86x4](https://github.com/goharbor/harbor/security/advisories/GHSA-884q-mjcg-86x4)) ([eb1a6fb64](https://github.com/goharbor/harbor/commit/eb1a6fb6424d523213eeac1faffd938cc687f2af)) - **medium:** Webhook error responses can cause unbounded decompression in Jobservice ([GHSA-jw3v-7jvc-pfmx](https://github.com/goharbor/harbor/security/advisories/GHSA-jw3v-7jvc-pfmx)) ([fb476e10c](https://github.com/goharbor/harbor/commit/fb476e10c9f981bd994011563bef6c5292ec272c)) - **medium:** scanner_registration.access_cred is missing filter:"false", giving a project admin a blind oracle over the scanner credential ([GHSA-vwvv-675v-p6rr](https://github.com/goharbor/harbor/security/advisories/GHSA-vwvv-675v-p6rr)) ([d2e2312f5](https://github.com/goharbor/harbor/commit/d2e2312f5735777b37041674bb146bcbd02fc054)) - **medium:** Registry chunk upload reuses unvalidated Location headers ([GHSA-wjpm-hv5w-gxr6](https://github.com/goharbor/harbor/security/advisories/GHSA-wjpm-hv5w-gxr6)) ([401e73429](https://github.com/goharbor/harbor/commit/401e7342963c4c406fd103cf2931e8aac95d320d)) - **medium:** Vulnerability & Content-Trust pull policies bypassable via attacker-controlled `User-Agent` header ([GHSA-wrw5-gmvj-gf23](https://github.com/goharbor/harbor/security/advisories/GHSA-wrw5-gmvj-gf23)) ([9d255ebe1](https://github.com/goharbor/harbor/commit/9d255ebe1ad3cae00929af2f8100cec566d9ee97)) - **medium:** SSRF and credential disclosure via attacker-controlled pagination Link header in the registry replication client ([GHSA-xgp2-5vxg-rgh2](https://github.com/goharbor/harbor/security/advisories/GHSA-xgp2-5vxg-rgh2)) ([a01e0c6c5](https://github.com/goharbor/harbor/commit/a01e0c6c561458fc719a16310d02b928a87e589a)) - **low:** Security middleware continues after AuthMode lookup failure ([GHSA-3x7c-wf86-mjx6](https://github.com/goharbor/harbor/security/advisories/GHSA-3x7c-wf86-mjx6)) ([bfd319a92](https://github.com/goharbor/harbor/commit/bfd319a928460e50ad8f0536b5e163cefb24ef5c)) ## Fixes - **api:** Advertise only https in the OpenAPI spec ([#1097](https://github.com/container-registry/harbor-next/issues/1097)) - **api:** Bound Audited And Manifest Request Bodies (backport [#1138](https://github.com/container-registry/harbor-next/issues/1138)) ([#1170](https://github.com/container-registry/harbor-next/issues/1170)) - **api:** Use valid OpenAPI 2.0 numeric format values ([#1098](https://github.com/container-registry/harbor-next/issues/1098)) - **authproxy:** Clear Leaked Local Sysadmin Flag In The http_auth /v2 Context (backport [#1128](https://github.com/container-registry/harbor-next/issues/1128)) ([#1149](https://github.com/container-registry/harbor-next/issues/1149)) - Constrain Pagination Link Next URL To The Request Origin (backport [#1134](https://github.com/container-registry/harbor-next/issues/1134)) ([#1157](https://github.com/container-registry/harbor-next/issues/1157)) - **core:** Serve the API docs page only when it is enabled ([#1096](https://github.com/container-registry/harbor-next/issues/1096)) - **core:** Set Secure and SameSite on the session cookie ([#1102](https://github.com/container-registry/harbor-next/issues/1102)) - **db:** Resolve the execution table through search_path in the revision guard (backport [#929](https://github.com/container-registry/harbor-next/issues/929)) ([#933](https://github.com/container-registry/harbor-next/issues/933)) - **deps:** Bump OpenTelemetry To v1.46.0 ([#1114](https://github.com/container-registry/harbor-next/issues/1114)) - **gc:** Use the current registry Redis URL for scheduled runs ([#1053](https://github.com/container-registry/harbor-next/issues/1053)) - **immutable:** Evaluate All Repository And Tag Selectors (backport [#1139](https://github.com/container-registry/harbor-next/issues/1139)) ([#1163](https://github.com/container-registry/harbor-next/issues/1163)) - **jobservice:** Unschedule periodic policy by ID instead of score ([#1055](https://github.com/container-registry/harbor-next/issues/1055)) - Keep the HTTPS port in the portal redirect and healthcheck ([#1064](https://github.com/container-registry/harbor-next/issues/1064)) - **member:** Require Project-Admin Authority To Grant The Project-Admin Role (backport [#1137](https://github.com/container-registry/harbor-next/issues/1137)) ([#1159](https://github.com/container-registry/harbor-next/issues/1159)) - Open the request transaction after the middlewares that read the DB ([#1058](https://github.com/container-registry/harbor-next/issues/1058)) - **orm:** Detach AfterCommit hooks from a cloned or copied context ([#1104](https://github.com/container-registry/harbor-next/issues/1104)) - **policy:** Stop User-Agent From Bypassing Content-Trust And Vulnerability Policies (backport [#1130](https://github.com/container-registry/harbor-next/issues/1130)) ([#1155](https://github.com/container-registry/harbor-next/issues/1155)) - **portal:** Line Up the Authentication Tab Controls ([#1082](https://github.com/container-registry/harbor-next/issues/1082)) - **quota:** Refresh usage before enforcing a changed hard limit (backport [#1123](https://github.com/container-registry/harbor-next/issues/1123)) ([#1153](https://github.com/container-registry/harbor-next/issues/1153)) - **rbac:** Stop Cover-All Robot Scope From Reaching Sub-Resources (backport [#1127](https://github.com/container-registry/harbor-next/issues/1127)) ([#1148](https://github.com/container-registry/harbor-next/issues/1148)) - **registry:** Reject Dot Segments In /v2/ Distribution Paths (backport [#1136](https://github.com/container-registry/harbor-next/issues/1136)) ([#1160](https://github.com/container-registry/harbor-next/issues/1160)) - **registry:** Validate Chunk-Upload Location Against The Registry Origin (backport [#1133](https://github.com/container-registry/harbor-next/issues/1133)) ([#1156](https://github.com/container-registry/harbor-next/issues/1156)) - Require Sysadmin Identity For Grants (backport [#1135](https://github.com/container-registry/harbor-next/issues/1135)) ([#1158](https://github.com/container-registry/harbor-next/issues/1158)) - Resolve audit and auth lookups on the request's own DB connection ([#1099](https://github.com/container-registry/harbor-next/issues/1099)) - **retention:** Require Durable Deletion Authority (backport [#1164](https://github.com/container-registry/harbor-next/issues/1164)) ([#1171](https://github.com/container-registry/harbor-next/issues/1171)) - **scanner:** Stop Filtering Scanner Registrations By access_cred (backport [#1129](https://github.com/container-registry/harbor-next/issues/1129)) ([#1150](https://github.com/container-registry/harbor-next/issues/1150)) - **scan:** Verify TLS And Bound Body On Scanner Bearer Token Request (backport [#1131](https://github.com/container-registry/harbor-next/issues/1131)) ([#1151](https://github.com/container-registry/harbor-next/issues/1151)) - **scheduler:** Ignore randomized seconds when comparing cron ([#1054](https://github.com/container-registry/harbor-next/issues/1054)) - **security:** Fail Closed When Auth Mode Lookup Fails (backport [#1132](https://github.com/container-registry/harbor-next/issues/1132)) ([#1152](https://github.com/container-registry/harbor-next/issues/1152)) - Send Cache-Control no-store On API And Static JSON Responses ([#1111](https://github.com/container-registry/harbor-next/issues/1111)) - Send Referrer-Policy And Permissions-Policy From Portal And Core ([#1112](https://github.com/container-registry/harbor-next/issues/1112)) - Send X-Content-Type-Options nosniff From Portal And Core ([#1110](https://github.com/container-registry/harbor-next/issues/1110)) - Send X-Frame-Options And CSP frame-ancestors From Portal And Core ([#1109](https://github.com/container-registry/harbor-next/issues/1109)) - Serve user settings from memory, synced by Postgres change notifications ([#1057](https://github.com/container-registry/harbor-next/issues/1057)) - Stop Scan All holding a pool connection per artifact ([#1100](https://github.com/container-registry/harbor-next/issues/1100)) - **webhook:** Block Private-Network Targets And Stop Reflecting Response Bodies (backport [#1140](https://github.com/container-registry/harbor-next/issues/1140)) ([#1172](https://github.com/container-registry/harbor-next/issues/1172)) ## Updates - **quota:** Coalesce per-request refresh through the deferred flush (backport [#719](https://github.com/container-registry/harbor-next/issues/719)) ([#1126](https://github.com/container-registry/harbor-next/issues/1126)) - **quota:** Skip usage reservation when hard limits are unlimited (backport [#734](https://github.com/container-registry/harbor-next/issues/734)) ([#1120](https://github.com/container-registry/harbor-next/issues/1120)) - Skip request-wide DB transaction for POST initiate blob upload ([#1059](https://github.com/container-registry/harbor-next/issues/1059)) ## Upstream - **gc:** do not count blobs missing from storage as freed space (goharbor/harbor[#23972](https://github.com/goharbor/harbor/issues/23972)) ([3188dc5](https://github.com/container-registry/harbor-next/commit/3188dc5d79c663c9d682e32286c6f578c1dad387)) - **repoproxy:** query robot account to validate proxy session and fix unit tests (goharbor/harbor[#23776](https://github.com/goharbor/harbor/issues/23776)) ([aa33a5a](https://github.com/container-registry/harbor-next/commit/aa33a5a0c1cc80077360a0441d8fbc9f88bdab8e)) - refactor(p2p): Redact credentials in HTTP client logging (goharbor/harbor[#23873](https://github.com/goharbor/harbor/issues/23873)) ([dcd74b7](https://github.com/container-registry/harbor-next/commit/dcd74b716fb414d0ec8147ab58ef13d33d412867)) - Refine utils function IsLocalPath (goharbor/harbor[#23756](https://github.com/goharbor/harbor/issues/23756)) ([9be4af4](https://github.com/container-registry/harbor-next/commit/9be4af4892df03c2bb793ed3b63bdc3cb75b2506)) - Remove hardcoded credentials and prevent passwords in logs (goharbor/harbor[#23835](https://github.com/goharbor/harbor/issues/23835)) ([61cbc87](https://github.com/container-registry/harbor-next/commit/61cbc8795c7f138f135d21d1c0e2ad2ac5e88e3a)) - Sanitize connection details in logs (goharbor/harbor[#23878](https://github.com/goharbor/harbor/issues/23878)) ([c4e3a96](https://github.com/container-registry/harbor-next/commit/c4e3a96c731e73d47004000ffd652c52841bba97)) ## Container Images Multi-arch images (`linux/amd64`, `linux/arm64`) signed with [cosign](https://github.com/sigstore/cosign). | Image | Reference | |-------|-----------| | `harbor-core` | `8gears.container-registry.com/8gcr/harbor-core:v2.15.10` | | `harbor-jobservice` | `8gears.container-registry.com/8gcr/harbor-jobservice:v2.15.10` | | `harbor-registryctl` | `8gears.container-registry.com/8gcr/harbor-registryctl:v2.15.10` | | `harbor-exporter` | `8gears.container-registry.com/8gcr/harbor-exporter:v2.15.10` | | `harbor-portal` | `8gears.container-registry.com/8gcr/harbor-portal:v2.15.10` | | `harbor-registry` | `8gears.container-registry.com/8gcr/harbor-registry:v2.15.10` | | `trivy-adapter` | `8gears.container-registry.com/8gcr/trivy-adapter:v2.15.10` | **Verify an image signature:** ```sh cosign verify \ --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ 8gears.container-registry.com/8gcr/harbor-core:v2.15.10 ```