---
title: "Helm Chart v2.1.0"
description: "Release notes for Helm Chart 2.1.0: a Harbor Grafana dashboard with pgx monitoring, browser security headers, a webhook SSRF guard and appVersion v2.15.13."
date: 2026-10-20
lastmod: 2026-10-20
canonical: "https://container-registry.com/docs/chart-releases/helm-chart-v2.1.0/"
source: "https://container-registry.com/docs/chart-releases/helm-chart-v2.1.0/index.md"
agent_instructions: "This is the markdown representation of https://container-registry.com/docs/chart-releases/helm-chart-v2.1.0/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt."
---

> Agent-friendly representation of <https://container-registry.com/docs/chart-releases/helm-chart-v2.1.0/index.md>. Site index: <https://container-registry.com/llms.txt>.


# Helm Chart v2.1.0

*Release notes for Helm Chart 2.1.0: a Harbor Grafana dashboard with pgx monitoring, browser security headers, a webhook SSRF guard and appVersion v2.15.13.*

Helm Chart v2.1.0
=================

Released 2026-10-19.

## Summary

Adds a Harbor Grafana dashboard for health, runtime, API traffic, storage, jobs and project usage. Switch installations using shared datasource, cluster and namespace selectors. The dashboard also highlights PostgreSQL/pgx monitoring available in the 8gcr Harbor distribution. Import the JSON directly or enable `metrics.grafanaDashboard.enabled` to provision it through a Grafana sidecar.

The portal and the API no longer render inside a frame on another site. If you embed the Harbor UI in an iframe, for example on a dashboard, that stops working after the upgrade. To keep it, supply your own portal nginx config through `portal.existingConfigMap`.

Fixes GHSA: [GHSA-2phj-cp9f-qq6w](https://github.com/goharbor/harbor/security/advisories/GHSA-2phj-cp9f-qq6w), "SSRF in webhook delivery allows ProjectAdmin to reach internal services and cloud metadata endpoints." Reported by **@OX-IgorStepansky** and **@iggypopi** (Igor Stepansky). The discovery is theirs.

Also fixes: GHSA-55x6-4mx9-528x, "Webhook notification delivery performs no private/loopback/link-local/metadata egress filtering (scheme is the only target constraint), follows attacker redirects with POST->GET conversion, and reflects non-2xx internal response bodies verbatim into project-readable task logs. The in-tree SSRF sanitizer ('Prevent SSRF #3755') is dead code: a Go range value-copy makes the sanitize write a no-op, and even if it ran it would not block internal IPs." Reported by **@e1024x**. The discovery is theirs.

Also fixes: GHSA-mxjq-7hr5-pq2q, "Webhook Notification Job Has No SSRF Protection, Internal Network Access." Reported by **@sermikr0** (Saidakbarxon Maxsudxonov). The discovery is theirs.

Webhook and Slack deliveries refuse private, loopback, link-local and metadata addresses, do not follow redirects and no longer echo the target's response body. Set network.allowPrivateNetworkAccess (chart) or HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS (compose) to true for trusted internal endpoints.

## Features

- **chart:** Add Harbor Grafana dashboard with 8gcr pgx monitoring ([#849](https://github.com/container-registry/harbor-next/issues/849))
- **chart:** Bump appVersion To v2.15.10 ([#1184](https://github.com/container-registry/harbor-next/issues/1184))
- **chart:** Bump chart appVersion to v2.15.13 ([#1272](https://github.com/container-registry/harbor-next/issues/1272))

## Fixes

- Send Cache-Control no-store On API And Static JSON Responses ([#992](https://github.com/container-registry/harbor-next/issues/992))
- Send Referrer-Policy And Permissions-Policy From Portal And Core ([#994](https://github.com/container-registry/harbor-next/issues/994))
- Send X-Content-Type-Options nosniff From Portal And Core ([#990](https://github.com/container-registry/harbor-next/issues/990))
- Send X-Frame-Options And CSP frame-ancestors From Portal And Core ([#989](https://github.com/container-registry/harbor-next/issues/989))
- **webhook:** Block Private-Network Targets And Stop Reflecting Response Bodies ([#1140](https://github.com/container-registry/harbor-next/issues/1140))

## Install

```sh
helm install harbor oci://8gears.container-registry.com/8gcr/charts/harbor \
  --version 2.1.0 -n harbor --create-namespace -f my-values.yaml
```

Signed with [cosign](https://github.com/sigstore/cosign). **Verify the chart signature:**
```sh
cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/publish-chart.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/charts/harbor:2.1.0
```

Default Harbor image tags follow the chart appVersion: `v2.15.13`.