GHSA-MF7Q-R4RV-JV94: Time-of-Check to Time-of-Use (TOCTOU) Signature Verification Bypass in Crossplane Runtime

Vulnerability ID: GHSA-MF7Q-R4RV-JV94
CVSS Score: 8.2
Published: 2026-08-27

Crossplane's runtime package manager engine contains a Time-of-Check to Time-of-Use (TOCTOU) race condition in its container signature verification pipeline. When Crossplane parses package definitions using dynamic tag-based references, it resolves the tag on the remote OCI registry twice: once during the signature verification step (the 'Check' phase) and once during the fetch and install step (the 'Use' phase). An attacker controlling the destination OCI registry can exploit this vulnerability by serving a validly signed benign image for the verification phase, and then dynamically swapping the tag to point to an unsigned, malicious package during the fetch phase.

TL;DR

A high-severity TOCTOU race condition in Crossplane's package client allows a malicious OCI registry to bypass Cosign signature checks. By swapping tag pointers between the verification step and the install step, the registry can force Crossplane to download and run unsigned, malicious packages.

Technical Details

• CWE ID: CWE-367
• Attack Vector: Network
• CVSS v4.0: 8.2
• EPSS Score: Not Applicable (No CVE Assigned)
• Impact: Signature Verification Bypass / Arbitrary Code Execution
• Exploit Status: None (No public exploit or PoC available)
• KEV Status: Not Listed

Affected Systems

• Crossplane Runtime
• Crossplane Package Manager client (xpkg.CachedClient)
• github.com/crossplane/crossplane-runtime: = 2.4.0-rc.0 (Fixed in: 2.4.0-rc.1)
• github.com/crossplane/crossplane-runtime: >= 2.3.0, <= 2.3.2 (Fixed in: 2.3.3)
• github.com/crossplane/crossplane-runtime: >= 2.2.0, < 2.2.3 (Fixed in: 2.2.3)

Mitigation Strategies

• Pin all Crossplane package specifications to immutable cryptographic digests instead of tag-based references.
• Deploy admission control rules to reject Crossplane Provider and Configuration resources that do not use SHA-256 digest mapping.
• Limit outbound cluster connectivity to verified, internally managed private OCI registries that implement strict image immutability policies.

Remediation Steps:

1. Identify all deployed Crossplane packages across the cluster.
2. For installations requiring tags, update the core Crossplane deployment to version v2.2.3, v2.3.3, or v2.4.0-rc.1.
3. For clusters unable to upgrade immediately, rewrite the spec.package field of all Provider and Configuration manifests to use the @sha256: digest format instead of tags.

References

• GitHub Security Advisory GHSA-mf7q-r4rv-jv94
• GitHub Advisory Database Entry
• Upstream Crossplane Runtime Repository

Read the full report for GHSA-MF7Q-R4RV-JV94 on our website for more details including interactive diagrams and full exploit analysis.