Crossplane EUVD-2026-92128

Exploitation requires ALL of: (1) Crossplane package signature verification configured via the ImageConfig mechanism; (2) packages installed using mutable tag references (e.g., semantic versions) rather than immutable image digests; and (3) installation from an OCI registry the victim does not control, where the attacker can serve different content between the cosign verification (Head/Validate) and the Fetch step. The TOCTOU window in CachedClient.Get resolves the tag separately for verification and fetch. Limiting factors: all three conditions are non-default/operational choices, and the attack is infeasible against installs pinned by digest (the documented mitigation) or from a registry the attacker cannot manipulate; impact is limited to installing an unverified package (integrity), with no direct confidentiality or availability impact per the vector.

This is a moderate, conditionally-exploitable supply-chain integrity flaw rather than a broad emergency. The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and score of 6.9 (MEDIUM) frame it as a remote, unauthenticated, low-integrity-impact issue with VI:L and VC:N/VA:N - confirming the harm is integrity-only (an unsigned/malicious package slipping past verification), not confidentiality or availability. No EPSS score was provided, there is no CISA KEV listing (status: no), and no public proof-of-concept is indicated, so by the precision rules this is 'no public exploit identified at time of analysis.' The GHSA advisory materially contradicts the PR:N 'default-config' impression: real exploitation requires THREE simultaneous conditions (signature verification enabled, tag-based installs, and pulling from an untrusted/attacker-controlled registry), which makes the practical attack surface narrower than the AC:L/PR:N vector implies. The 'network' and 'no privileges' metrics are technically accurate (the attacker operates a malicious OCI registry over the network, needing no credentials on the Crossplane system) but the TOCTOU race and configuration preconditions mean this is targeted, not opportunistic/wormable. Bottom line: a credible, well-documented defense-in-depth bypass worth patching on a normal cycle, but not a high-urgency 'drop everything' item absent evidence of exploitation; the main gap is missing EPSS and any telemetry on real-world abuse.

An organization enables Crossplane package signature verification but installs packages by tag (e.g., a semantic version) from a third-party OCI registry it does not control. The attacker, controlling or compromising that registry, serves a correctly-signed image when Crossplane performs the cosign verification (the 'check'), then serves a different unsigned/malicious image when Crossplane subsequently fetches by the same tag (the 'use'), installing unverified code into the control plane. No public exploit code is identified, but the attack is reliable because the attacker fully controls the registry's responses between the two requests.