Executive brief
Crossplane Runtime's package manager can be tricked into installing unsigned packages through a time-of-check-time-of-use (TOCTOU) race condition in signature verification. When pulling packages by tag reference from untrusted registries, an attacker can serve a correctly signed image for verification, then swap it with an unsigned malicious image during installation. This allows installation of unverified packages that could contain malicious code.
Technical details
The vulnerability exists in the xpkg package manager's CachedClient.Get function, which resolves OCI tag references separately for signature verification and image fetching. An attacker controlling a registry can perform a race condition attack, serving a signed image during verification and an unsigned image during fetch. The fix resolves tag references once and uses the resulting digest for both operations. The vulnerability requires three preconditions: signature verification configured, tag-based (not digest-based) installation, and use of untrusted registries.
Affected products
- Crossplane Runtime 2.3.0 to 2.3.2, 2.4.0-rc.0 to 2.4.0-rc.0
Timeline
- 2026-06-15: disclosed
- 2026-06-16: patched: Fix released in v2.3.3 and v2.2.3