vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-105163

crossplane crossplane-runtime ImageConfig client.go Get toctou

MEDIUM
5.3
CVSS Score
Published: October 4, 2026 at 09:30 PM UTC
Updated: October 6, 2026 at 03:04 PM UTC
1 product affected across 1 vendorCrossplane Runtime

Using crossplane-runtime by crossplane?

Get instant alerts when new vulnerabilities affect crossplane-runtime - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.3
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Crossplane Runtime· Crossplane
60%
2.2.02.2.12.2.22.3.02.3.12.3.2
Vendor states this is fixed in 2.2.3 (unaffected)
Vendor states this is fixed in 2.3.3 (unaffected)
Vendor states this is fixed in 2.4.0-rc.1 (unaffected)

References (8)

VDB EntryTechnical Description
Source: cverecord
https://vuldb.com/vuln/413395
SignaturePermissions Required
Source: cverecord
https://vuldb.com/vuln/413395/cti
Third Party Advisory
Source: cverecord
https://vuldb.com/cve/CVE-2026-105163
Issue Tracking
Source: cverecord
https://github.com/advisories/GHSA-mf7q-r4rv-jv94
Issue TrackingPatch
Source: cverecord
https://github.com/crossplane/crossplane-runtime/pull/1038
Patch
Source: cverecord
https://github.com/crossplane/crossplane-runtime/commit/bee99c6cd6ca81878acca2940a2f0a02169fc208
Patch
Source: cverecord
https://github.com/crossplane/crossplane-runtime/releases/tag/v2.2.3
Product
Source: cverecord
https://github.com/crossplane/crossplane-runtime/

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.3MEDIUMVulDB
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-367CWE-362

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card