283 matches found
GO-2026-6302 vulnerabilities
Vulnerabilities for packages: crossplane-function-auto-ready-fips, crossplane-function-auto-ready...
GO-2026-6302 Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2...
GO-2026-6225 vulnerabilities
Vulnerabilities for packages: kubeflow-katib, crossplane, knative-serving-fips, tekton-pipelines, crossplane-fips, tekton-pipelines-fips, security-profiles-operator, knative-serving...
CLEANSTART-2026-KP99907 Security fixes in crossplane 2.3.4-r2
Package crossplane version 2.3.4-r2 fixes 4 vulnerabilities: CVE-2026-56864, CVE-2026-56865, ghsa-259r-337f-4rfw, CVE-2026-54787...
GHSA-MF7Q-R4RV-JV94 vulnerabilities
Vulnerabilities for packages: crossplane-function-auto-ready-fips, crossplane-function-auto-ready...
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check
Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...
GHSA-MF7Q-R4RV-JV94 Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check
Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the CachedClient.Get flow in pkg/xpkg/client.go. An attacker controlling an OCI registry can serve one signed image to fetcher.Head and validator.Validate, then swap the tag to differe...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the CachedClient.Get flow in pkg/xpkg/client.go. An attacker controlling an OCI registry can serve one signed image to fetcher.Head and validator.Validate, then swap the tag to differe...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the CachedClient.Get flow in pkg/xpkg/client.go. An attacker controlling an OCI registry can serve one signed image to fetcher.Head and validator.Validate, then swap the tag to differe...
WS-2026-0058
crossplane-runtime's xpkg.CachedClient.Get resolved a package tag to a digest with fetcher.Head, had cosign verify that digest, and then re-fetched the image by the original tag - so the verified digest and the pulled bytes came from two independent registry requests. A registry serving different...
GO-2026-6112 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-organizations, crossplane-provider-aws-pinpoint, crossplane-provider-aws-scheduler, crossplane-provider-aws-fis-fips, crossplane-provider-aws-codestarnotifications, crossplane-provider-aws-cloudfront-fips, crossplane-provider-aws-inspector,...
GO-2026-6095 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-organizations, crossplane-provider-aws-pinpoint, crossplane-provider-aws-scheduler, crossplane-provider-aws-fis-fips, crossplane-provider-aws-codestarnotifications, crossplane-provider-aws-cloudfront-fips, crossplane-provider-aws-inspector,...
GO-2026-6162 vulnerabilities
Vulnerabilities for packages: cloudbeat, aactl, zarf-fips, neuvector-sigstore-interface-fips, kubescape, kubescape-server, kyverno, trivy-operator, teleport, cloudbeat-fips, tekton-chains, kubescape-server-fips, kyverno-fips, falcoctl, cosign-fips, tbot, kyverno-notation-aws, trivy,...
GO-2026-6095 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-sns, crossplane-provider-aws-kinesis, crossplane-provider-aws-memorydb, crossplane-provider-azure-storage, crossplane-provider-family-aws, crossplane-provider-aws-route53, crossplane-provider-aws-cloudfront,...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: rancher-system-agent, pulumi-kubernetes-operator, rancher, metrics-server, apisix-ingress-controller, cert-manager-webhook-pdns, datadog-agent, hubble, cilium, k3s, kube-state-metrics, kapp-controller, kubernetes, kubescape, kubernetes-csi-external-health-monitor,...
GO-2026-6162 vulnerabilities
Vulnerabilities for packages: trivy-operator, kubescape, aactl, tkn, policy-controller, flux-source-controller, neuvector-sigstore-interface, ko, tekton-chains, zarf, skaffold, goreleaser, spire-server, zot, kyverno, crossplane, trivy, kyverno-notation-aws, falcoctl...
CVE-2026-56858 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-organizations, cloudbeat, image-factory, k6-operator-fips, net-kourier-fips, ory-kratos, zarf-fips, cert-manager-csi-driver-fips, kubescape, plutono, crossplane-provider-aws-pinpoint, podinfo-fips, crossplane-provider-aws-scheduler,...