Go/github.com/crossplane/crossplane/v2: unknown

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5709#Go/github.com/crossplane/crossplane/v2
• https://github.com/crossplane/crossplane/security/advisories/GHSA-wfqx-gjrf-g28r

published 2026-06-25T22:34:38Z · modified 2026-06-25T23:01:29.683499860Z · JSON