crossplane github.com/crossplane/crossplane-runtime vulnerabilities

Latest crossplane github.com/crossplane/crossplane-runtime CVEs

Newest publication first

1. CVE-2026-105163 crossplane crossplane-runtime ImageConfig client.go Get toctou

   Published 2026-10-04

   Medium·CVSS 6.9 EPSS 0.32%

   A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Up...

2. CVE-2023-27483 fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

   Published 2023-03-09

   High·CVSS 7.5 EPSS 0.80%

   crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input wi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.