Executive brief
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane
Affected products
- Go github.com/crossplane/crossplane
- Go github.com/crossplane/crossplane/v2
Junglewise Threat Intelligence
GO-2026-5709 - Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane
Severity: info · Published 2026-06-25
Technologies: github.com/crossplane/crossplane (Go). Vendors: Go.
Related threats
- GO-2024-3219 - github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
- GO-2023-1980 - Possible image tampering from missing image validation for Packages in github.com/crossplane/crossplane
- GO-2023-1979 - Denial of service from large image in github.com/crossplane/crossplane