Crossplane vulnerable to possible image tampering from missing image validation for Packages

published 2023-07-27 3 y ago modified 2026-09-10 1 mo ago also BIT-crossplane-2023-38495 , EUVD-2023-2113 , GHSA-pj4x-2xr5-w87m , GO-2023-1980

cvss: 8.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits: 0; none known

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.

Patch / fix

fixed in 3

go github.com/crossplane/crossplane 1.11.5, 1.12.3
bitnami crossplane 1.11.5, 1.12.3
crossplane crossplane 1.11.5, 1.12.3

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-10-10)

Exploit prediction

0.84% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
GitHub	3.1	8.3	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/crossplane/crossplane	<1.11.5 >=1.12.0, <1.12.3	1.11.5 1.12.3
bitnami	crossplane	<1.11.5 >=1.12.0, <1.12.3	1.11.5 1.12.3

Affected products

crossplane crossplane

Classification

Weakness

CWE-20 Improper Input Validation

References

github.com /crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf
web, exploit, technical-description, vendor-advisory, advisory
github.com /crossplane/crossplane/security/advisories/GHSA-pj4x-2xr5-w87m
web, vendor-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2023-38495
advisory, web
github.com /crossplane/crossplane
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary