EUVD-2026-92128

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

CVE-2026-105163

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

CVE-2026-105163 crossplane crossplane-runtime ImageConfig client.go Get toctou

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

CVE-2026-105163 crossplane crossplane-runtime ImageConfig client.go Get toctou

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

CVE-2026-105163

A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in crossplane-runtime up to versions 2.2.2 and 2.3.2 . The flaw specifically affects the Get function within the pkg/xpkg/client.go file of the ImageConfig component. This issue may be exploited via a remote attack vector. T...

CVE-2026-105163 crossplane crossplane-runtime ImageConfig client.go Get toctou

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

CVE-2026-105163: Time-of-check Time-of-use (TOCTOU) Race Condition

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

PT-2026-104649

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

WS-2026-0058

crossplane-runtime's xpkg.CachedClient.Get resolved a package tag to a digest with fetcher.Head, had cosign verify that digest, and then re-fetched the image by the original tag - so the verified digest and the pulled bytes came from two independent registry requests. A registry serving different...