CVE-2026-105163

Received Received - Intake

Time-of-Check Time-of-Use in Crossplane Runtime

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulDB

Description

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-04

Last Modified

2026-10-04

Generated

2026-10-05

AI Q&A

2026-10-05

EPSS Evaluated

N/A

NVD

CVE-2026-105163

Affected Vendors & Products

Vendor	Product	Version / Range
crossplane	crossplane-runtime	to 2.3.2 (inc)
crossplane	crossplane-runtime	2.2.3
crossplane	crossplane-runtime	2.3.3
crossplane	crossplane-runtime	2.4.0-rc.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a time-of-check time-of-use (TOCTOU) issue in the Get function of pkg/xpkg/client.go in crossplane-runtime versions up to 2.2.2/2.3.2. It allows remote attackers to manipulate the component ImageConfig due to improper validation timing.

Detection Guidance

This vulnerability is specific to Crossplane crossplane-runtime versions up to 2.2.2/2.3.2 and can be detected by checking the installed version of the component. Use commands like 'kubectl get pods -n crossplane-system' to inspect Crossplane components and verify versions. Compare the version against the patched versions (2.2.3, 2.3.3, or 2.4.0-rc.1).

Impact Analysis

The vulnerability may allow remote attackers to alter ImageConfig data improperly, potentially leading to unauthorized changes or disruptions in the crossplane-runtime system. This could affect the integrity of operations relying on this component.

Compliance Impact

The vulnerability involves a time-of-check time-of-use issue in the Get function of pkg/xpkg/client.go, which could allow unauthorized access or manipulation of data. This may impact compliance with GDPR by potentially violating data integrity and security requirements, and with HIPAA by risking unauthorized access to protected health information.

Mitigation Strategies

Upgrade the affected component crossplane-runtime to version 2.2.3, 2.3.3, or 2.4.0-rc.1 to resolve the time-of-check time-of-use vulnerability.

Hi! I’m here to help you understand CVE-2026-105163. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70