Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 9 September 2026.

Which products and versions are affected?

Crossplane Runtime 2.3.0 to 2.3.2, 2.4.0-rc.0 to 2.4.0-rc.0; github.com/crossplane/crossplane-runtime/v2 (Go) SEMVER:introduced=2.3.0,fixed=2.3.3,introduced=2.4.0-rc.0,fixed=2.4.0-rc.1.

Is there a fix for This vulnerability?

Yes. github.com/crossplane/crossplane-runtime/v2 (Go): upgrade to 2.4.0-rc.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Crossplane Runtime or github.com/crossplane/crossplane-runtime/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Crossplane Runtime signature verification TOCTOU race condition

Severity: info · Published 2026-09-09

Crossplane Runtime's package manager can be tricked into installing unsigned packages through a time-of-check-time-of-use (TOCTOU) race condition in signature verification. When pulling packages by tag reference from untrusted registries, an attacker can serve a correctly signed image for verification, then swap it with an unsigned malicious image during installation. This allows installation of unverified packages that could contain malicious code.

Technologies: Crossplane Runtime. Vendors: Crossplane, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 9 September 2026.
Which products and versions are affected?: Crossplane Runtime 2.3.0 to 2.3.2, 2.4.0-rc.0 to 2.4.0-rc.0; github.com/crossplane/crossplane-runtime/v2 (Go) SEMVER:introduced=2.3.0,fixed=2.3.3,introduced=2.4.0-rc.0,fixed=2.4.0-rc.1.
Is there a fix for This vulnerability?: Yes. github.com/crossplane/crossplane-runtime/v2 (Go): upgrade to 2.4.0-rc.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Crossplane Runtime or github.com/crossplane/crossplane-runtime/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/crossplane/crossplane-runtime/v2 (Go): upgrade to 2.4.0-rc.1 or later
```
go get github.com/crossplane/crossplane-runtime/v2@v2.4.0-rc.1
```

Technical details

The vulnerability exists in the xpkg package manager's CachedClient.Get function, which resolves OCI tag references separately for signature verification and image fetching. An attacker controlling a registry can perform a race condition attack, serving a signed image during verification and an unsigned image during fetch. The fix resolves tag references once and uses the resulting digest for both operations. The vulnerability requires three preconditions: signature verification configured, tag-based (not digest-based) installation, and use of untrusted registries.

Affected products

Crossplane Runtime 2.3.0 to 2.3.2, 2.4.0-rc.0 to 2.4.0-rc.0

Timeline

2026-06-15: disclosed
2026-06-16: patched: Fix released in v2.3.3 and v2.2.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.