CVE-2022-31666: Harbor Webhook Policies User Permissions Validation Failure
Summary
CVE-2022-31666: Harbor fails to validate the user permissions when viewing Webhook policies. Affects github.com/goharbor/harbor across 3 version ranges.
>= 1.0.0, < 1.10.13
>= 2.0.0, < 2.4.3
>= 2.5.0, < 2.5.2
Fixed in 1.10.13, 2.4.3 or 2.5.2, depending on the release line you run. How to fix ↓
Also tracked for
- harbor · Bitnami
The same CVE-2022-31666 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Harbor is an open-source container registry that allows users to store, sign, and scan container images. It provides features such as vulnerability scanning, access control, and image replication. The vulnerability described in this report affects versions 1.0.0 to 1.10.12, 2.0.0 to 2.4.2, and 2.5.0 to 2.5.1 of the Harbor package.
Vulnerability Detail
The vulnerability in Harbor allows malicious users to view Webhook policies and related credentials of other users or projects without proper permission validation. By exploiting this vulnerability, an attacker can send a GET request to the API endpoint '/projects/{project_name_or_id}/webhook/policies/{webhook_policy_id}' with different webhook policy IDs to disclose sensitive information. This can lead to unauthorized access to repositories and projects, compromising the confidentiality of the system. The vulnerability has a CVSS score of 7.7 (High).
How To Fix
Latest published version: v2.15.4+incompatible as of 23 Oct 2026
go get github.com/goharbor/harbor@v2.15.4+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.10.131.10.13go get github.com/goharbor/harbor@v1.10.13 -
>= 2.0.0, < 2.4.32.4.3go get github.com/goharbor/harbor@v2.4.3 -
>= 2.5.0, < 2.5.22.5.2go get github.com/goharbor/harbor@v2.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds available for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of Harbor.
Conclusion
The vulnerability in Harbor's Webhook policies user permissions validation can lead to unauthorized access to sensitive information. It is crucial to upgrade to the patched versions of Harbor to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/goharbor/harbor →
FAQ
Harbor is an open-source container registry used for storing and managing container images.
A Webhook policy in Harbor is a configuration that defines actions to be triggered when specific events occur, such as pushing a new image to a repository.
An attacker can exploit this vulnerability by sending a specially crafted request to the Harbor API endpoint, allowing them to view Webhook policies and related credentials of other users or projects.
The vulnerability allows unauthorized access to sensitive information, potentially compromising the confidentiality of repositories and projects in Harbor.
To mitigate the risk, it is recommended to upgrade to the patched versions of Harbor (1.10.13, 2.4.3, or 2.5.2 or later) as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/goharbor/harbor.
