Crossplane package manager signature bypass via TOCTOU in tag resolution

Severity: high · CVSS 8.2 · Published 2026-08-27

Crossplane's package manager allows administrators to enforce code signing verification for installed packages. However, when packages are installed using version tags (e.g., "v1.0.0") rather than cryptographic digests, an attacker controlling a package registry could serve a legitimately signed image during verification, then swap it with an unsigned or malicious image during installation. This allows attackers to inject unsigned code into systems that rely on signature verification for security.

Technologies: Crossplane Runtime. Vendors: Crossplane.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.2, published 27 August 2026.
Which products and versions are affected?
Crossplane Runtime >= 2.3.0, <= 2.3.2; = 2.4.0-rc.0.
Is there a fix for This vulnerability?
A patch was published on 2026-08-27: Patches released in v2.3.3, v2.2.3, and v2.4.0-rc.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Crossplane Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a time-of-check time-of-use (TOCTOU) race condition in Crossplane's package management system, specifically in the xpkg.CachedClient component. When a package is installed using a tag reference (e.g., a semantic version tag), Crossplane resolves the tag to an OCI image digest separately during two phases: first when verifying the package signature using cosign, and again when actually fetching the image for installation. A malicious OCI registry operator can exploit this by serving a legitimately signed image during the verification phase, then serving a different unsigned or malicious image when the same tag is resolved during the fetch phase. This attack requires the victim to have signature verification enabled, use tag-based (rather than digest-based) package installation, and pull packages from a registry not under their direct control. The fix resolves the tag reference once and caches the resulting digest, using the same digest for both verification and fetching operations. Patches are available in v2.3.3, v2.2.3, and v2.4.0-rc.1.

Affected products

  • Crossplane crossplane-runtime >= 2.3.0, <= 2.3.2; = 2.4.0-rc.0

Timeline

  • 2026-06-15: disclosed
  • 2026-08-27: advisory
  • 2026-08-27: patched: Patches released in v2.3.3, v2.2.3, and v2.4.0-rc.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.