CVE-2017-17697
HighSummary
The Ping() function in ui/api/target.go in Harbor through version 1.3.0-rc4 has an SSRF vulnerability via the endpoint parameter to /api/targets/ping.
Risk Assessment
An attacker could exploit this vulnerability to send requests to internal services, potentially leading to the disclosure of sensitive data or system compromise.
Recommendation
It is recommended to update Harbor to the latest version to eliminate this vulnerability and review application security to minimize risk.
Other vulnerabilities in Harbor
See all- CVE-2026-111590Low risk· EPSS 11%
A wide range of Harbor versions allow SSRF via its webhook delivery component, which does not properly validate webhook target addresses, allowing use of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address; when a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target, and error response bodies are written to the webhook execution log readable by project members.
- CVE-2026-92770Medium
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts.
Original NVD description (English source)
The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS