goharbor/harbor · error · *errors.Error

PROJECTPOLICYVIOLATION

PROJECTPOLICYVIOLATION

Error message

current image without vulnerability scanning cannot be pulled due to configured policy in 'Prevent images with vulnerability severity of "%s" or higher from running.' To continue with pull, please contact your project administrator for help.

What it means

Error "current image without vulnerability scanning cannot be pulled due to configured policy in 'Prevent images with vulnerability severity of "%s" or higher from running.' To continue with pull, please contact your project administrator for help." thrown in goharbor/harbor.

Source

Thrown at src/server/middleware/vulnerable/vulnerable.go:101

		vulnerable, err := scanController.GetVulnerable(ctx, art, allowlist, proj.CVEAllowlist.IsExpired())
		if errors.IsNotFoundErr(err) {
			// When the scanner is disconnected the artifact will be considered not scannable.
			// We'll try to check the existing scan report even when it's not scannable, and only if there is no report, we will skip checking the vulnerability.
			checker := scanChecker()
			scannable, err := checker.IsScannable(ctx, art)
			if err != nil {
				logger.Errorf("check the scannable status of the artifact %s@%s failed, error: %v", art.RepositoryName, art.Digest, err)
				return err
			}
			if !scannable {
				logger.Debugf("artifact %s@%s does not have a scan report, and it is not scannable, skip the checking", art.RepositoryName, art.Digest)
				return nil
			}
			// If the artifact is scannable but there's no report, it's a violation.
			msg := fmt.Sprintf(`current image without vulnerability scanning cannot be pulled due to configured policy in 'Prevent images with vulnerability severity of "%s" or higher from running.' `+
				`To continue with pull, please contact your project administrator for help.`, projectSeverity)
			return errors.New(nil).WithCode(errors.PROJECTPOLICYVIOLATION).WithMessage(msg)
		} else if err != nil {
			logger.Errorf("get vulnerability summary of the artifact %s@%s failed, error: %v", art.RepositoryName, art.Digest, err)
			return err
		}

		if art.IsImageIndex() {
			// artifact is image index, skip the checking when it is in the allowlist
			skippingAllowlist := []string{image.ArtifactTypeImage, cnab.ArtifactTypeCNAB}
			if slices.Contains(skippingAllowlist, art.Type) {
				logger.Debugf("artifact %s@%s is image index and its type is %s in skipping allowlist, "+
					"skip the vulnerability prevention checking", art.RepositoryName, art.Digest, art.Type)
				return nil
			}
		}

		if !vulnerable.IsScanSuccess() {
			msg := fmt.Sprintf(`current image with "%s" status of vulnerability scanning cannot be pulled due to configured policy in 'Prevent images with vulnerability severity of "%s" or higher from running.' `+
				`To continue with pull, please contact your project administrator for help.`, vulnerable.ScanStatus, projectSeverity)

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/server/middleware/vulnerable/vulnerable.go:101 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/c1f4707c3e44d380. Report an issue: GitHub.