CVE-2026-105163: Crossplane crossplane-runtime time-of-check time-of-use in package verification

CVE-2026-105163 · Severity: medium · CVSS 5.3 · Published 2026-10-04

Crossplane's package manager verifies package signatures using cosign before installation. A time-of-check time-of-use (TOCTOU) flaw allows a malicious OCI registry to serve a correctly signed package for verification, then swap it with an unsigned or malicious package during installation. This affects users who enable signature verification, install packages by tag (not digest), and use untrusted registries.

Technologies: Crossplane Runtime. Vendors: Crossplane.

Quick answers

Is CVE-2026-105163 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105163 being exploited in the wild.
How severe is CVE-2026-105163?
Medium severity, with a CVSS score of 5.3, published 4 October 2026.
Which products and versions are affected?
Crossplane Runtime up to 2.2.2; 2.3.0 to 2.3.2.
Is there a fix for CVE-2026-105163?
Yes: fixed in 2.2.3, 2.3.3, 2.4.0-rc.1. Until then: Install packages by image digest rather than by tag reference to avoid this vulnerability, as digest references uniquely identify package content and bypass the tag resolution race condition. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105163 attacked?
It is attacked over the network.
Am I affected by CVE-2026-105163?
Check whether you run Crossplane Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2.2.3, 2.3.3, 2.4.0-rc.1

Install packages by image digest rather than by tag reference to avoid this vulnerability, as digest references uniquely identify package content and bypass the tag resolution race condition.

Technical details

The ImageConfig component in pkg/xpkg/client.go resolves OCI image tag references separately for signature verification and image fetching, creating a race condition. An attacker controlling an OCI registry can exploit this by providing one image for cosign verification and a different image for the actual pull operation. The vulnerability requires configuration of signature verification and use of tag-based (rather than digest-based) package references.

Affected products

  • Crossplane crossplane-runtime up to 2.2.2; 2.3.0 to 2.3.2

Timeline

  • 2026-06-15: disclosed
  • 2026-06-15: patched: Fix applied to main branch and backported to v2.2 and v2.3
  • 2026-08-27: advisory: GitHub Advisory Database updated
  • 2026-10-04: advisory: NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.