How severe is GHSA-wfqx-gjrf-g28r?

GHSA-wfqx-gjrf-g28r has a CVSS score of 9/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by GHSA-wfqx-gjrf-g28r?

GHSA-wfqx-gjrf-g28r affects the following packages: github.com/crossplane/crossplane/v2 (Go), github.com/crossplane/crossplane/v2 (Go), github.com/crossplane/crossplane (Go). Ecosystems affected: Go.

How do I fix GHSA-wfqx-gjrf-g28r?

No patched version of github.com/crossplane/crossplane/v2 has shipped for GHSA-wfqx-gjrf-g28r yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.

How do I detect GHSA-wfqx-gjrf-g28r in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/crossplane/crossplane/v2. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-wfqx-gjrf-g28r if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-wfqx-gjrf-g28r?

O3 pinpoints whether GHSA-wfqx-gjrf-g28r is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-wfqx-gjrf-g28r actively exploited in the wild?

No public exploit code has been indexed for GHSA-wfqx-gjrf-g28r yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-wfqx-gjrf-g28r published, and has it been updated?

GHSA-wfqx-gjrf-g28r was published on June 19, 2026 and was last updated on June 25, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹 Go

GHSA-wfqx-gjrf-g28r

CRITICAL

GHSA-wfqx-gjrf-g28r is a critical-severity (CVSS 9) vulnerability in github.com/crossplane/crossplane/v2. O3 Security confirms whether GHSA-wfqx-gjrf-g28r is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

Also known asGO-2026-5709

Published

Jun 19, 2026

Updated

Jun 25, 2026

Affected

3 pkgs

Patched

None yet

Exploits

None indexed

Blast Radius

3 pkgs affected

🐹github.com/crossplane/crossplane/v2🐹github.com/crossplane/crossplane/v2🐹github.com/crossplane/crossplane

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them.

When a package is installed using a tag reference (e.g., a semantic version), a malicious OCI registry could serve a correctly signed image for verification, then subsequently serve an unsigned image for installation. This is possible because Crossplane resolves the tag reference separately for each step.

This vulnerability is relevant only for users who do all three of the following:

Configure signature verification for packages,
Install packages using tag references rather than digests, and
Install packages from registries they do not control.

Mitigation

Installing packages by image digest rather than using tags avoids this issue.

Fix

The package manager has been updated to resolve tag references once and use the resulting digest for both signature verification and image fetching. This ensures that Crossplane pulls the same content that had its signature verified. The fix has been applied to Crossplane's main branch and backported to the v2.3 and v2.2 release branches; it will be released in v2.3.3 and v2.2.3.

Credits

This issue was reported, independently, by @bugbunny-research and @tonghuaroot.

Affected Packages

3 total

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/crossplane/crossplane/v2`	≥ 2.3.0-rc.0	No fix
🐹Go	`github.com/crossplane/crossplane/v2`	all versions	No fix
🐹Go	`github.com/crossplane/crossplane`	all versions	No fix

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/crossplane/crossplane/v2. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Remediation status
No patched version of github.com/crossplane/crossplane/v2 has shipped for GHSA-wfqx-gjrf-g28r yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-wfqx-gjrf-g28r is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-wfqx-gjrf-g28r. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary Crossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference (e.g., a semantic version), a malicious OCI registry could serve a correctly signed image for verification, then subsequently serve an unsigned image for installation. This is possible because Crossplane resolves the tag reference separately for each step. This vulnerability is relevant only for users who do

O3 Security · Impact-Aware SCA

Is GHSA-wfqx-gjrf-g28r in your dependencies?

O3 detects GHSA-wfqx-gjrf-g28r across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works