When you run vulnerability scans, images that are subject to Common Vulnerabilities and Exposures (CVE) are identified. According to the severity of the CVE and your security settings, these images might not be permitted to run. As a Harbor system administrator, you can create allowlists of CVEs to ignore during vulnerability scanning.

You can set a system-wide CVE allowlist or you can set CVE allowlists on a per-project basis. For information about per-project CVE allowlists, see Configure a Per-Project CVE Allowlist.

System-wide CVE allowlists apply to all of the projects in a Harbor instance.

1. Go to Configuration > Security.

2. Under Deployment security, click Add.

3. Enter the list of CVE IDs to ignore during vulnerability scanning.

   

   Either use a comma-separated list or newlines to add multiple CVE IDs to the list.

4. Click Add at the bottom of the window to add the list.

5. Optionally uncheck the Never expires checkbox and use the calendar selector to set an expiry date for the allowlist.

   

6. Click Save at the bottom of the page to save your settings.

After you have created a system allowlist, you can remove CVE IDs from the list by clicking the delete button next to it in the list. You can click Add to add more CVE IDs to the system allowlist.