crossplane has 7 CVEs on record between 2023 and 2026. 3 were published in the last 90 days. The median CVSS is 7.2 (high), with 2 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-367 (3). Most affected products: github.com/crossplane/crossplane (3), github.com/crossplane/crossplane-runtime/v2 (2), crossplane-runtime (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 3 prev 1
Products
- github.com/crossplane/crossplane 3
- github.com/crossplane/crossplane-runtime/v2 2
- crossplane-runtime 1
- github.com/crossplane/crossplane/v2 1
Worst active — by depth score
GHSA-7h65-4p22-39j6Critical· 9.8github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses54GHSA-wfqx-gjrf-g28rCritical· 9.0Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag50GHSA-mf7q-r4rv-jv94HighCrossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature…41CVE-2026-105163Medium· 5.3A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.229CVE-2023-37900Low· 3.4Denial of service from large image19
crossplane vulnerabilities
CVEs affecting crossplane, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-105163Medium· 5.3A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-u…
GO-2026-6302NoneSignature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
GHSA-mf7q-r4rv-jv94HighCrossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature…
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check
GHSA-wfqx-gjrf-g28rCritical· 9.0Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag
GO-2024-3219Nonegithub.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
GHSA-7h65-4p22-39j6Critical· 9.8github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2023-37900Low· 3.4Denial of service from large image
Denial of service from large image