GO-2026-6302None▾ SunlitSignature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
github.com/crossplane/crossplane-runtime/v2 >= 2.4.0-rc.0, < 2.4.0-rc.1Upgrade to a patched release:
github.com/crossplane/crossplane-runtime/v2 2.4.0-rc.1Connected by shared product, vendor, weakness, or advisory.
GHSA-mf7q-r4rv-jv94HighCrossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature…
CVE-2023-37900Low· 3.4Denial of service from large image
GO-2024-3219Nonegithub.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
GHSA-7h65-4p22-39j6Critical· 9.8github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
GHSA-wfqx-gjrf-g28rCritical· 9.0Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag