CVE-2026-105163 crossplane crossplane-runtime ImageConfig client.go Get toctou
A time-of-check time-of-use race condition in the ImageConfig Get function allows remote attackers to bypass security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-105163?
CVE-2026-105163 is a medium-severity vulnerability in crossplane-runtime, published on 4 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.
Which versions are affected by CVE-2026-105163?
5 open source packages ship an affected version, including github.com/crossplane/crossplane-runtime/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/crossplane/crossplane-runtime/v2 Go | From 2.3.0 | 2.3.3, 2.4.0-rc.1 |
github.com/crossplane/crossplane-runtime/v2 Go | From 2.3.0 | 2.3.3 |
github.com/crossplane/crossplane-runtime/v2 Go | From 2.3.0 | 2.3.3 |
github.com/crossplane/crossplane-runtime/v2 Go | From 2.4.0-rc.0 | 2.4.0-rc.1 |
github.com/crossplane/crossplane-runtime/v2 Go | From 2.4.0-rc.0 | 2.4.0-rc.1 |
How do I fix CVE-2026-105163?
Upgrade github.com/crossplane/crossplane-runtime/v2 to a fixed version for your release line: 2.3.3 or 2.4.0-rc.1.
Is CVE-2026-105163 being exploited?
There is no known exploitation of CVE-2026-105163 in the wild and no public exploit code.
Sources
Also known as GHSA-92mr-7mjc-w93g, GHSA-mf7q-r4rv-jv94, GO-2026-6302, MINI-3p76-966j-h2pr, MINI-hrhq-x8hw-6xv9.