Time-of-check Time-of-use Issue in Crossplane Runtime by Crossplane
CVE-2026-105163

6.9MEDIUM

Key Information:

Vendor

Crossplane

Status
Crossplane-runtime
Vendor
CVE Published:
4 October 2026

What is CVE-2026-105163?

A vulnerability exists within the Get function of the ImageConfig component in Crossplane's crossplane-runtime up to versions 2.2.2 and 2.3.2, allowing for potential time-of-check time-of-use exploitation. This remotely exploitable vulnerability can lead to unauthorized access or manipulation of system resources. Users are advised to upgrade to versions 2.2.3, 2.3.3, or 2.4.0-rc.1, where the issue has been addressed.

Affected Version(s)

crossplane-runtime 2.2.0

crossplane-runtime 2.2.1

crossplane-runtime 2.2.2

References

https://vuldb.com/vuln/413395
vdb-entrytechnical-description
https://vuldb.com/vuln/413395/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105163
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bugbunny-research
tonghuaroot
VulDB GitHub Commit Analyzer
.