Executive brief
Crossplane's package manager allows administrators to enforce code signing verification for installed packages. However, when packages are installed using version tags (e.g., "v1.0.0") rather than cryptographic digests, an attacker controlling a package registry could serve a legitimately signed image during verification, then swap it with an unsigned or malicious image during installation. This allows attackers to inject unsigned code into systems that rely on signature verification for security.
Technical details
The vulnerability is a time-of-check time-of-use (TOCTOU) race condition in Crossplane's package management system, specifically in the xpkg.CachedClient component. When a package is installed using a tag reference (e.g., a semantic version tag), Crossplane resolves the tag to an OCI image digest separately during two phases: first when verifying the package signature using cosign, and again when actually fetching the image for installation. A malicious OCI registry operator can exploit this by serving a legitimately signed image during the verification phase, then serving a different unsigned or malicious image when the same tag is resolved during the fetch phase. This attack requires the victim to have signature verification enabled, use tag-based (rather than digest-based) package installation, and pull packages from a registry not under their direct control. The fix resolves the tag reference once and caches the resulting digest, using the same digest for both verification and fetching operations. Patches are available in v2.3.3, v2.2.3, and v2.4.0-rc.1.
Affected products
- Crossplane crossplane-runtime >= 2.3.0, <= 2.3.2; = 2.4.0-rc.0
Timeline
- 2026-06-15: disclosed
- 2026-08-27: advisory
- 2026-08-27: patched: Patches released in v2.3.3, v2.2.3, and v2.4.0-rc.1