CVE-2026-105163

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.

• CWE-362
• CWE-367

• https://github.com/advisories/GHSA-mf7q-r4rv-jv94
• https://github.com/crossplane/crossplane-runtime/
• https://github.com/crossplane/crossplane-runtime/commit/bee99c6cd6ca81878acca2940a2f0a02169fc208
• https://github.com/crossplane/crossplane-runtime/pull/1038
• https://github.com/crossplane/crossplane-runtime/releases/tag/v2.2.3
• https://vuldb.com/cve/CVE-2026-105163
• https://vuldb.com/vuln/413395
• https://vuldb.com/vuln/413395/cti

Published

Oct 4, 2026

Last Modified

Oct 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105148A vulnerability was identified in SciPhi-AI R2R up to 3.6.6.…7.3
• CVE-2026-105149A security flaw has been discovered in mooSocial up to 3.2.4…7.3
• CVE-2026-105156A weakness has been identified in YzmCMS up to 7.6. Impacted…3.7
• CVE-2026-105157A security vulnerability has been detected in RainyGao DocSy…4.3
• CVE-2026-105158A vulnerability was detected in RainyGao DocSys up to 2.02.8…7.3
• CVE-2026-105161A flaw has been found in invariant-systems-ai aiir up to 1.7…5.3
• CVE-2026-105164A flaw has been found in NASA cFS up to 7.0.1. This issue af…2.7
• CVE-2026-105165A vulnerability has been found in devopspolis secrets-replic…6.3
• CVE-2026-105166A vulnerability was found in kishor-23 food-waste-management…7.3
• CVE-2026-105167A vulnerability was determined in kishor-23 food-waste-manag…7.3
• CVE-2026-105168A vulnerability was identified in kishor-23 food-waste-manag…6.3
• CVE-2026-105169A security flaw has been discovered in kishor-23 food-waste-…7.3