Skip to content

4.13.0#

This section contains the release notes for MSR 4.13.0, including enhancements, component versions, known issues, and resolved Common Vulnerabilities and Exposures (CVEs).

Enhancements#

MSR-specific Enhancements#

  • Added support for nested groups in the LDAP Group Admin search filter.
  • Updated the Docker Compose installation packages to reference msr instead of harbor.
  • Updated the Helm chart to reference msr and Mirantis instead of harbor.
  • Added recommendations for the following operators to deploy PostgreSQL and Redis in high availability (HA) mode:
    • PostgreSQL: zalando/postgres-operator
    • Redis: OT-CONTAINER-KIT/redis-operator
  • Updated the following components:
    • Golang to 1.23.7
    • beego Go Web Framework to 2.3.6
    • Aqua Trivy Vulnerability Scanner to 0.60.0
    • Go Cryptography Libraries golang.org/x/crypto to 0.35.0
    • go-jose JSON Object Signing and Encryption for Go to 4.0.5
    • OAuth 2.0 for Go golang.org/x/oauth2 to 0.27.0

Harbor Highlights#

MSR 4.13.0 comprises the Harbor 2.11, 2.12, and 2.13 upstream releases. The following upstream pull requests and features are relevant to MSR.

Note

For complete upstream details, refer to:

What’s New#

  • Implemented the capability to generate Software Bills of Materials (SBOMs) both manually and automatically. Users can view, download, and replicate SBOMs across multiple Harbor instances.
  • Added full support for OCI Distribution Spec v1.1.0.
  • Added support for replicating images to and from the VolcEngine registry.
  • Improved robot account functionality to enhance access control and automate CI/CD processes.
  • Implemented the capability for administrators to set bandwidth limits for proxy cache projects.
  • Improved LDAP user onboarding speed and authentication performance.
  • Added replication support for Azure Container Registry (ACR) and ACR Enterprise Edition.
  • Extended audit logging to provide more detailed user action and API logging with improved query performance.
  • Added user session logout and Proof Key for Code Exchange (PKCE) support to the OIDC integration.
  • Implemented the CloudNativeAI integration to manage, version, and retrieve AI models directly in Harbor.
  • Added TLS encryption for Redis communication to secure data in transit.
  • Extended Dragonfly preheating with additional parameters, customizable scopes, and cluster ID targeting for optimized image distribution.

Deprecations#

  • Removed robotV1 from the code base (#20991) by @sgaist

Breaking Changes#

  • Update CSRF key generation (#21154) by @wy65701436
  • Remove with_signature (#21420) by @wy65701436

Minor Enhancements#

  • Enable MAX_JOB_DURATION_SECONDS in the jobservice container (#21232) by @stonezdj
  • Extend P2P preheat policy (#21115) by @chlins
  • Fix replication rule message in UI (#21299) by @bupd
  • Add execution_id and task_id to replication webhook payload (#21614) by @chlins
  • Add audit log support (#21377) by @xuelichao
  • Revamp Copy Pull Command (#21155) by @bupd
  • Add PKCE support for OIDC authentication (#21702) by @reasonerjt
  • Add Persistent Page Size UI (#21627) by @bupd
  • Add list project artifacts API (#20803) by @wy65701436
  • Export Harbor statistics as Prometheus metrics (#18679) by @tpoxa
  • Refactor P2P preheat Dragonfly driver (#20922) by @chlins
  • Enable build of the spectral image on ARM (#20506) by @Vad1mo

Component Versions#

Component Version
Harbor 2.11–2.13
Golang 1.23.8
Distribution v2.8.3-23-g0c62ec3e
PostgreSQL 15.12
Redis 7.2.6
Trivy scanner 0.61.0
Trivy adapter 0.33.0-rc.2
NGINX 1.26.2

Known Issues#

This section describes the MSR 4.13.0 known issues with available workarounds, along with current product limitations.

Configuration Audit Log Written to Audit Log on Configuration Change#

Severity: Medium

MSR writes the configuration payload (ldap_search_password and oidc_client_secret) to the audit log when the configuration changes.

As a workaround, disable audit logging in the MSR system settings.

Security Information#

The following table summarizes the Common Vulnerabilities and Exposures (CVEs) that MSR 4.13.0 resolves in the MSR images. The severity ratings come from the National Vulnerability Database (NVD) and reflect the NVD data as of November 6, 2026.

Severity CVEs
Critical 1
High 9
Medium 9
Low 1
Total 20
MSR 4.13.0 resolved CVEs detailed
CVE Severity Problem details from upstream
CVE-2025-30223 Critical Beego prior to 2.3.6 is vulnerable to XSS via the RenderForm() function, allowing injection of malicious JavaScript. Fixed in 2.3.6.
CVE-2025-47273 High setuptools <78.1.1 vulnerable to path traversal allowing file writes to arbitrary locations. Fixed in 78.1.1.
CVE-2025-30204 High golang-jwt versions before 5.2.2 and 4.5.2 are vulnerable to excessive memory allocation during token parsing. Fixed in 5.2.2 and 4.5.2.
CVE-2025-27516 High Jinja <3.1.6 allows sandbox escape using the |attr filter to access unsafe attributes. Fixed in 3.1.6.
CVE-2025-22869 High SSH servers implementing file transfer protocols may face DoS via slow key exchange completion.
CVE-2025-22868 High Malformed tokens could consume excessive memory during parsing.
CVE-2024-56326 High Jinja <3.1.5 allows sandbox bypass via indirect str.format calls. Fixed in 3.1.5.
CVE-2024-56201 High Jinja <3.1.5 allows RCE when both filename and content of a template are attacker-controlled. Fixed in 3.1.5.
CVE-2024-40635 High In containerd <1.6.38, containers with large UID:GID values could overflow to root privileges. Fixed in containerd 1.6.38+.
CVE-2024-6345 High Vulnerability in setuptools ≤69.1.1 allows RCE via malicious package URLs. Fixed in 70.0.
CVE-2025-32387 Medium A JSON Schema file in a Helm chart can create recursive references, causing a stack overflow. Fixed in Helm v3.17.3.
CVE-2025-32386 Medium Specially crafted chart archives can expand disproportionately, exhausting memory. Fixed in Helm v3.17.3.
CVE-2025-27144 Medium Go JOSE <4.0.5 could consume excessive memory when parsing JWTs with many periods. Fixed in 4.0.5.
CVE-2025-24976 Medium In registry 3.0.0-beta.1–3.0.0-rc.2, token authentication may accept untrusted signing keys. Fixed in 3.0.0-rc.3.
CVE-2025-22872 Medium The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g., <math>, <svg>, etc.).
CVE-2025-22870 Medium IPv6 zone IDs may be misinterpreted as hostnames during proxy matching.
CVE-2024-45341 Medium Certificates with IPv6 zone IDs may incorrectly satisfy URI name constraints.
CVE-2024-45336 Medium HTTP clients could incorrectly resend sensitive headers after certain redirects.
CVE-2019-25210 Medium A vulnerability in Helm through 3.13.3 where the --dry-run flag displays secret values. The behavior is intentional for backward compatibility but may expose sensitive data in CI/CD environments.
CVE-2025-29923 Low go-redis versions before 9.5.5, 9.6.3, and 9.7.3 could return out-of-order responses during connection setup. Fixed in newer releases.

Note

The CVE-2025-22868 may still appear in the trivy-adapter-photon image. However, the image is not affected by the vulnerability.

Note

MSR enables you to download the Software Bill of Materials (SBOM) of any MSR 4.13.0 image to confirm the resolved CVEs by scanning its packages with your own security tools. For details, see Retrieving SBOMs for MSR Images.