Log in Start free

Vulnerability · Published Oct 4, 2026 · Assigned by VulDB

CVE-2026-105163crossplane crossplane-runtime ImageConfig client.go Get toctou

Medium 5.3

In plain English

A medium-severity race condition in crossplane-runtime from crossplane. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 74.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/crossplane/crossplane-runtime/v22.4.0-rc.1GHSA-mf7q-r4rv-jv94
Gogithub.com/crossplane/crossplane-runtime/v22.3.3GHSA-mf7q-r4rv-jv94
Gogithub.com/crossplane/crossplane-runtime/v22.3.3, 2.4.0-rc.1GO-2026-6302

Affected products (as reported)

VendorProductVersions
crossplane crossplane-runtime 2.2.02.2.12.2.22.3.02.3.12.3.2

Weakness: CWE-367, CWE-362 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

References