{"id":"CVE-2026-105163","revision":null,"records":[{"revision":"bdb37b22d42a42d48c787dd87d73aa53","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-105163","aliases":[],"title":"crossplane crossplane-runtime ImageConfig client.go Get toctou","description":"A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.","state":0,"publishedAt":"2026-10-04T21:30:12.785+00:00","modifiedAt":"2026-10-05T15:11:53.371+00:00","affected":[{"ecosystem":"Vendor product","name":"crossplane-runtime","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"crossplane\",\n                    \"product\": \"crossplane-runtime\",\n                    \"versions\": [\n                        {\n                            \"version\": \"2.2.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.2.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.2.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.3.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.3.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.3.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.2.3\",\n                            \"status\": \"unaffected\"\n                        },\n                        {\n                            \"version\": \"2.3.3\",\n                            \"status\": \"unaffected\"\n                        },\n                        {\n                            \"version\": \"2.4.0-rc.1\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:2.3:a:crossplane:crossplane-runtime:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"modules\": [\n                        \"ImageConfig\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C","score":5,"severity":null}],"references":["https://vuldb.com/vuln/413395","https://vuldb.com/vuln/413395/cti","https://vuldb.com/cve/CVE-2026-105163","https://github.com/advisories/GHSA-mf7q-r4rv-jv94","https://github.com/crossplane/crossplane-runtime/pull/1038","https://github.com/crossplane/crossplane-runtime/commit/bee99c6cd6ca81878acca2940a2f0a02169fc208","https://github.com/crossplane/crossplane-runtime/releases/tag/v2.2.3","https://github.com/crossplane/crossplane-runtime/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105163","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-105163","identifiers":["CVE-2026-105163"]},"retained":false,"historicalAffected":[]},{"revision":"1cbef7d9fd0447d2ac9c667a5c3293b9","observedAt":"2026-11-11T05:30:42.409+00:00","statement":{"source":"euvd","id":"EUVD-2026-92128","aliases":["CVE-2026-105163","GHSA-92mr-7mjc-w93g"],"title":"A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use.…","description":"A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X","score":6.9,"severity":null}],"references":["https://vuldb.com/vuln/413395","https://vuldb.com/vuln/413395/cti","https://vuldb.com/cve/CVE-2026-105163","https://github.com/advisories/GHSA-mf7q-r4rv-jv94","https://github.com/crossplane/crossplane-runtime/pull/1038","https://github.com/crossplane/crossplane-runtime/commit/bee99c6cd6ca81878acca2940a2f0a02169fc208","https://github.com/crossplane/crossplane-runtime/releases/tag/v2.2.3","https://github.com/crossplane/crossplane-runtime/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92128","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 4, 2026, 9:30:12 PM","dateUpdated":"Oct 5, 2026, 3:11:53 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-92128","identifiers":["EUVD-2026-92128","CVE-2026-105163","GHSA-92mr-7mjc-w93g"]},"retained":false,"historicalAffected":[]},{"revision":"7a8b2c39f91b4f839934c7cd91253678","observedAt":"2026-10-25T04:17:29.458+00:00","statement":{"source":"nvd","id":"CVE-2026-105163","aliases":[],"title":"A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use.…","description":"A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.","state":0,"publishedAt":"2026-10-04T22:16:58.763+00:00","modifiedAt":"2026-10-06T15:04:52.637+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · cna@vuldb.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · cna@vuldb.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 2.0 · cna@vuldb.com · Secondary","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","score":5,"severity":"MEDIUM"}],"references":["https://github.com/advisories/GHSA-mf7q-r4rv-jv94","https://github.com/crossplane/crossplane-runtime/","https://github.com/crossplane/crossplane-runtime/commit/bee99c6cd6ca81878acca2940a2f0a02169fc208","https://github.com/crossplane/crossplane-runtime/pull/1038","https://github.com/crossplane/crossplane-runtime/releases/tag/v2.2.3","https://vuldb.com/cve/CVE-2026-105163","https://vuldb.com/vuln/413395","https://vuldb.com/vuln/413395/cti"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105163","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-362","CWE-367"],"productCriteria":[],"sourceDates":{"published":"2026-10-04T22:16:58.763","lastModified":"2026-10-06T15:04:52.637"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-105163","identifiers":["CVE-2026-105163"]},"retained":false,"historicalAffected":[]},{"revision":"39b41a8331e543dc981897c3ca4638c3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-mf7q-r4rv-jv94","aliases":["CVE-2026-105163","GO-2026-6302"],"title":"Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check","description":"## Summary\n\nCrossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them.\n\nWhen a package is installed using a tag reference (e.g., a semantic version), a malicious OCI registry could serve a correctly signed image for verification, then subsequently serve an unsigned image for installation. This is possible because Crossplane resolves the tag reference separately for each step.\n\nThis vulnerability is relevant only for users who do all three of the following:\n\n1. Configure signature verification for packages,\n2. Install packages using tag references rather than digests, and\n3. Install packages from registries they do not control.\n\n## Mitigation\n\nInstalling packages by image digest rather than using tags avoids this issue.\n\n## Fix\n\nThe package manager has been updated to resolve tag references once and use the resulting digest for both signature verification and image fetching. This ensures that Crossplane pulls the same content that had its signature verified. The fix has been applied to Crossplane's `main` branch and backported to the v2.3 and v2.2 release branches; it will be released in v2.3.3 and v2.2.3.\n\n## Credits\n\nThis issue was reported, independently, by @bugbunny-research and @tonghuaroot.","state":0,"publishedAt":"2026-08-27T17:25:25+00:00","modifiedAt":"2026-10-05T10:55:34.9242989+00:00","affected":[{"ecosystem":"Go","name":"github.com/crossplane/crossplane-runtime/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.4.0-rc.0"},{"kind":"fixed","version":"2.4.0-rc.1"}]}],"versions":["2.4.0-rc.0"],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/crossplane/crossplane-runtime/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.3.0"},{"kind":"fixed","version":"2.3.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/crossplane/crossplane-runtime/security/advisories/GHSA-mf7q-r4rv-jv94","https://github.com/crossplane/crossplane-runtime"],"sourceUrl":"https://github.com/advisories/GHSA-mf7q-r4rv-jv94","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mf7q-r4rv-jv94","identifiers":["GHSA-mf7q-r4rv-jv94","CVE-2026-105163","GO-2026-6302"]},"retained":false,"historicalAffected":[]},{"revision":"1b1522bef15a4b9b8767d72aab28b0ed","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6302","aliases":["CVE-2026-105163","GHSA-mf7q-r4rv-jv94"],"title":"Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2","description":"Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2","state":0,"publishedAt":"2026-09-09T17:56:34+00:00","modifiedAt":"2026-10-05T10:55:34.9242989+00:00","affected":[{"ecosystem":"Go","name":"github.com/crossplane/crossplane-runtime/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.3.0"},{"kind":"fixed","version":"2.3.3"},{"kind":"introduced","version":"2.4.0-rc.0"},{"kind":"fixed","version":"2.4.0-rc.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/crossplane/crossplane-runtime/security/advisories/GHSA-mf7q-r4rv-jv94","https://github.com/crossplane/crossplane-runtime/pull/1038","https://github.com/crossplane/crossplane-runtime/commit/bee99c6cd6ca81878acca2940a2f0a02169fc208","https://github.com/crossplane/crossplane-runtime/releases/tag/v2.3.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6302","license":"OSV · upstream source license applies","key":"osv:GO-2026-6302","identifiers":["GO-2026-6302","CVE-2026-105163","GHSA-mf7q-r4rv-jv94"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T14:57:42.7555955+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T14:57:42.7555955+00:00","lastSuccessAt":"2026-11-11T14:57:42.9319568+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.9319577+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-19109df301f45af5f6ac2ef04012c27245f9ad888d1e548bcdb48fe76d9f96e6","complete":true,"records":424146,"lastAttemptAt":"2026-11-11T14:57:42.3158203+00:00","lastSuccessAt":"2026-11-11T14:57:42.1205118+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.3158203+00:00","snapshotPublishedAt":"2026-11-11T14:27:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-daa70f0e05b540b28ec429806bdccfc4","complete":false,"records":13759,"lastAttemptAt":"2026-11-11T15:09:37.2726122+00:00","lastSuccessAt":"2026-11-11T15:09:37.269+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:09:37.269+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13582,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T14:57:42.7555955+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T14:57:42.7555955+00:00","lastSuccessAt":"2026-11-11T14:57:42.9331503+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.9331505+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-11785b13898646a1917b06b09d2df4a4","complete":true,"records":13753,"lastAttemptAt":"2026-11-11T14:57:44.6046058+00:00","lastSuccessAt":"2026-11-11T13:57:34.909+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:57:34.909+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T14:57:42.5803744+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.5803744+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T14:57:42.3614093+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.3614093+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T14:57:42.6953487+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.6953487+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-10cb353ca77c2a8069d6892d1d394d936b12c0add3c8749e2a1a03a1c5d50426","complete":true,"records":231666,"lastAttemptAt":"2026-11-11T14:57:42.4738411+00:00","lastSuccessAt":"2026-11-11T12:59:55.8981437+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.4738411+00:00","snapshotPublishedAt":"2026-11-11T12:32:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}