A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.
PUBLISHED5.2ApplicationCWE-367CWE-362x_open-source
crossplane crossplane-runtime ImageConfig client.go Get toctou
Problem type
Affected products
crossplane
crossplane-runtime
2.2.0 - AFFECTED
2.2.1 - AFFECTED
2.2.2 - AFFECTED
2.3.0 - AFFECTED
2.3.1 - AFFECTED
2.3.2 - AFFECTED
2.2.3 - UNAFFECTED
2.3.3 - UNAFFECTED
2.4.0-rc.1 - UNAFFECTED
References
VDB-413395 | crossplane crossplane-runtime ImageConfig client.go Get toctou
https://vuldb.com/vuln/413395
VDB-413395 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/413395/cti
CVE-2026-105163 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-105163
github.com
https://github.com/advisories/GHSA-mf7q-r4rv-jv94
github.com
https://github.com/crossplane/crossplane-runtime/pull/1038
github.com
https://github.com/crossplane/crossplane-runtime/commit/bee99c6cd6ca81878acca2940a2f0a02169fc208
github.com
https://github.com/crossplane/crossplane-runtime/releases/tag/v2.2.3
github.com
https://github.com/crossplane/crossplane-runtime/
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-105163Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-105163",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"dateUpdated": "2026-10-04T21:30:12.785Z",
"dateReserved": "2026-10-04T07:28:17.729Z",
"datePublished": "2026-10-04T21:30:12.785Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-10-04T21:30:12.785Z"
},
"title": "crossplane crossplane-runtime ImageConfig client.go Get toctou",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component."
}
],
"affected": [
{
"vendor": "crossplane",
"product": "crossplane-runtime",
"cpes": [
"cpe:2.3:a:crossplane:crossplane-runtime:*:*:*:*:*:*:*:*"
],
"modules": [
"ImageConfig"
],
"versions": [
{
"version": "2.2.0",
"status": "affected"
},
{
"version": "2.2.1",
"status": "affected"
},
{
"version": "2.2.2",
"status": "affected"
},
{
"version": "2.3.0",
"status": "affected"
},
{
"version": "2.3.1",
"status": "affected"
},
{
"version": "2.3.2",
"status": "affected"
},
{
"version": "2.2.3",
"status": "unaffected"
},
{
"version": "2.3.3",
"status": "unaffected"
},
{
"version": "2.4.0-rc.1",
"status": "unaffected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Time-of-check Time-of-use",
"cweId": "CWE-367",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "Race Condition",
"cweId": "CWE-362",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://vuldb.com/vuln/413395",
"name": "VDB-413395 | crossplane crossplane-runtime ImageConfig client.go Get toctou",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/413395/cti",
"name": "VDB-413395 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-105163",
"name": "CVE-2026-105163 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/advisories/GHSA-mf7q-r4rv-jv94",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/crossplane/crossplane-runtime/pull/1038",
"tags": [
"issue-tracking",
"patch"
]
},
{
"url": "https://github.com/crossplane/crossplane-runtime/commit/bee99c6cd6ca81878acca2940a2f0a02169fc208",
"tags": [
"patch"
]
},
{
"url": "https://github.com/crossplane/crossplane-runtime/releases/tag/v2.2.3",
"tags": [
"patch"
]
},
{
"url": "https://github.com/crossplane/crossplane-runtime/",
"tags": [
"product"
]
}
],
"metrics": [
{},
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_0": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"cvssV2_0": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
"baseScore": 5
}
}
],
"timeline": [
{
"time": "2026-10-04T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-10-04T02:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-10-04T09:33:30.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "bugbunny-research",
"type": "finder"
},
{
"lang": "en",
"value": "tonghuaroot",
"type": "finder"
},
{
"lang": "en",
"value": "VulDB GitHub Commit Analyzer",
"type": "tool"
}
],
"tags": [
"x_open-source"
]
}
}
}