GHSA-mf7q-r4rv-jv94

GHSA-mf7q-r4rv-jv94 PUBLISHED CVSS 7.5 HIGH

Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Vendor	Product	Versions
github.com	crossplane/crossplane-runtime/v2	2.3.0, 2.4.0-rc.0
chainguard	crossplane-function-auto-ready	0
chainguard	crossplane-function-auto-ready-fips	0