Skip to content
OpenAdvisories

Vendor

crossplane

5 known vulnerabilities.

Products

crossplane 3 crossplane-runtime 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-105163

    crossplane crossplane-runtime ImageConfig client.go Get toctou

    A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be …

    crossplane crossplane-runtime github.com/crossplane/crossplane-runtime/v2 Go
  • Medium 6.2
    CVE-2023-27484

    Unchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplane

    crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly privileged user able to create or update Compositions can specify an arbitrarily high index in a patc…

    crossplane crossplane github.com/crossplane/crossplane Go
  • Medium 5.9
    CVE-2023-27483

    fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

    crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the `Paved` type's `SetValue` method wi…

    crossplane crossplane-runtime github.com/crossplane/crossplane-runtime Go