#23299·harbor

Robots are unable to rotate secrets of other robots

Author: 0xC4DECreated May 28, 2026Updated Sep 14, 2026
Labelskind/bugStalearea/robot-account

Expected behavior and actual behavior: According to https://github.com/goharbor/harbor/blob/main/src/server/v2.0/handler/robot.go#L263

A user/robot needs the "rbac.ActionUpdate" permission in order to update the security of a robot. (error seems to originate from this section of code: https://github.com/goharbor/harbor/blob/8b8223313bc874058a0e064428f970919a2a6206/src/server/v2.0/handler/base.go#L135-L138)

Image However, robots cannot be granted that robots.ActionUpdate permission per this menu inside of the edit robots permission.

Steps to reproduce the problem: Create two system-level robots, one with every system permission, the other with none Query the API with PATCH https://{harbor}/api/v2.0/robots/{robot_id}/ log-in should be bot with all permissions Recieve a FORBIDDEN with "message": "{logged-in account name}"

  • harbor version: v2.14.4