—
GO-2026-5709
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane
Details
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/crossplane/crossplane
Introduced in:
0No fixed version published yet for github.com/crossplane/crossplane (go modules). Pin to a known-safe version or switch to an alternative.
Go/github.com/crossplane/crossplane/v2
Introduced in:
2.3.0-rc.0No fixed version published yet for github.com/crossplane/crossplane/v2 (go modules). Pin to a known-safe version or switch to an alternative.