Description
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
crossplane crossplane-runtime
2.2.0affected2.2.1affected2.2.2affected2.3.0affected2.3.1affected2.3.2affected2.2.3unaffected2.3.3unaffected2.4.0-rc.1unaffected
References
- https://vuldb.com/vuln/413395 ↗
- https://vuldb.com/vuln/413395/cti ↗
- https://vuldb.com/cve/CVE-2026-105163 ↗
- https://github.com/advisories/GHSA-mf7q-r4rv-jv94 ↗
- https://github.com/crossplane/crossplane-runtime/pull/1038 ↗
- https://github.com/crossplane/crossplane-runtime/commit/bee99c6cd6ca81878acca2940a2f0a02169fc208 ↗
- https://github.com/crossplane/crossplane-runtime/releases/tag/v2.2.3 ↗
- https://github.com/crossplane/crossplane-runtime/ ↗