VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/crossplane/crossplane: vulnerability history, versions and safety

github.com/crossplane/crossplane is a package in the Go ecosystem. Vulert records 8 vulnerabilities for it across 120 releases, from Mar 2023 to Jun 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
8 vulnerabilities recorded C1 H1 M1 L1 U4
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
1 in the last 12 months

Most recent disclosure 25 Jun 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/crossplane/crossplane vulnerabilities

Vulert verdict on github.com/crossplane/crossplane v1.20.14 i

Updated on 23 Oct 2026

Careful: v1.20.14 has 6 known vulnerabilities, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.20.14 — affected i
  • Vulnerabilities on record 8 over 3 years · 1 in the last year i
  • Latest disclosure 25 Jun 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 1 i
  • Stars 12,184 i
  • OpenSSF scorecard 8/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/crossplane/crossplane, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.20.14 22 Oct 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.14-0.20260925162146-93e26c541cab 25 Sep 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.13 14 Sep 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.12 21 Aug 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.12-0.20260801163955-0d1fee5677b5 01 Aug 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.11 23 Jul 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.11-0.20260716152839-b8870c3b6df3 16 Jul 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.11-0.20260703105704-343f2e613be4 03 Jul 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v0.0.0-20260622133635-f31c99471a50 22 Jun 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.10 22 Jun 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.9 05 Jun 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.8 22 May 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.7 24 Apr 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.6 20 Apr 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.5 03 Feb 2026 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.4 01 Dec 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.3 06 Nov 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.2 01 Nov 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250730221455-56f2f81d1329 30 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v0.0.0-20250730163451-524338edf402 30 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250728214523-7de208e2b58a 28 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250726153700-9fa5bc14b802 26 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250725181918-02294d5ec303 25 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250724001507-29005e67fc6f 24 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250722213050-b98b81cd9688 22 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250722091026-148bc49a5f76 22 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250721080030-e4e442e27027 21 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250719013812-a8fefac610e5 19 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250718042914-4d232691c424 18 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250717195014-35e100e951b9 17 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250717162006-2d5e4103a85d 17 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250716155604-1a331af4453e 16 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.1 14 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250712044748-30938ef73ab1 12 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250710235007-a2f1fcdbc3ba 10 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250708024238-b22c2bb24d30 08 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250707185840-fdc0c3a142a4 07 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250703071907-0ca7bac77f76 03 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250702215644-33ecf7aab9ef 02 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250702194846-a11f37e02dab 02 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250701180108-8f06f34dbecf 01 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250701155142-d69da24d09d5 01 Jul 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250630163957-bd4622b953f6 30 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250626013544-00e1a7050923 26 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250625041835-106493b50b12 25 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250624054852-c47b065786b5 24 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250617154416-c111dc08b33a 17 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250615090840-beaba4735893 15 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250613125703-160125d58fec 13 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250612143141-7732724605e0 12 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250612131546-84784eb6227b 12 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.18.6-0.20250611091740-08ab6fa3a032 11 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.3 11 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250611091615-a243a85e603f 11 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250610183800-c6863bd656a8 10 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250607044241-44e6ef4e4dd5 07 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250607033935-c5d08b8b089d 07 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250605003055-5d7557bebd9c 05 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250603002301-f3cf223d70df 03 Jun 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250529094950-0b8bfcb49859 29 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250527202103-fdc074f45388 27 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250521134413-539f0066278b 21 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0 21 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250521004324-8a346d0e4a1b 21 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0.0.20250514071140-a5a8f62fbbfd 14 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.21.0-rc.0 14 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.1 14 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.17.7-0.20250501180123-a3f32a26cf0b 01 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.18.5 01 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.2 01 May 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.0.0.20250424193323-27cfa238e8e8 24 Apr 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.0.0.20250420082220-b0cc38c104eb 20 Apr 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.0.0.20250414081722-f5d7f90ee95d 14 Apr 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.2-0.20250403080209-6c24c9dc7c8a 03 Apr 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.0.0.20250329032035-815fa2bba1a0 29 Mar 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.17.6 26 Mar 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.18.4 26 Mar 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.1 26 Mar 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.0.0.20250326163835-05a7fe1a4199 26 Mar 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.0.0.20250321221400-b90c89203554 21 Mar 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.0.0.20250211175805-db456f661408 11 Feb 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0 11 Feb 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.0.0.20250207171808-d1587b448497 07 Feb 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.18.3 06 Feb 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.0.0.20250204191907-c103f2187f38 04 Feb 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0-rc.1 04 Feb 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.20.0-rc.0 04 Feb 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0-rc.0.0.20250123212104-06846a4dc70a 23 Jan 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0-rc.0.0.20250108204025-cd64e64cda1b 08 Jan 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.17.5 08 Jan 2025 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0-rc.0.0.20241231101014-5adaccbcced9 31 Dec 2024 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0-rc.0.0.20241217235131-8feba11892d4 17 Dec 2024 H1 M1 L1 U3 Apache-2.0 No Details →
v1.16.5 17 Dec 2024 H1 M1 L1 U3 Apache-2.0 No Details →
v1.17.4 17 Dec 2024 H1 M1 L1 U3 Apache-2.0 No Details →
v1.18.2 17 Dec 2024 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0-rc.0.0.20241206144911-0d806babb24d 06 Dec 2024 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0-rc.0.0.20241204024018-4b3dd0d5150a 04 Dec 2024 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0-rc.0.0.20241203092013-c36d6caca0a5 03 Dec 2024 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0-rc.0.0.20241202105159-dbd27126a8ce 02 Dec 2024 H1 M1 L1 U3 Apache-2.0 No Details →
v1.18.1 29 Nov 2024 H1 M1 L1 U3 Apache-2.0 No Details →
v1.19.0-rc.0.0.20241129092020-daf3111e0698 29 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241127145416-9967f459b394 27 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241126021513-99ac82d17438 26 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241118171932-ea5d79669892 18 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241115181256-184951c4bdc4 15 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241114122613-329cdcc9acf8 14 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241113085855-e98f4f3cb7bd 13 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241112075654-935ed91789ab 12 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241105100702-586bd39a2436 05 Nov 2024 H1 M1 L1 U3 — No Details →
v1.18.0 05 Nov 2024 H1 M1 L1 U3 — No Details →
v1.16.4 05 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241105084855-1d38953572aa 05 Nov 2024 H1 M1 L1 U3 — No Details →
v1.17.3 05 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241103083609-e4d72e53d33c 03 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241101092030-05da2e6da979 01 Nov 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0.0.20241031174003-0a030eb7a9c7 31 Oct 2024 H1 M1 L1 U3 — No Details →
v1.19.0-rc.0 31 Oct 2024 H1 M1 L1 U3 — No Details →
v1.18.0-rc.1 31 Oct 2024 H1 M1 L1 U3 — No Details →
v1.16.3 25 Oct 2024 H1 M1 L1 U3 — No Details →
v1.15.6 24 Oct 2024 H1 M1 L1 U3 — No Details →

The newest 120 of 606 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2023 3
  • 2024 4
  • 2026 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 1 of the 8 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/crossplane/crossplane

The 5 most severe of 8 vulnerabilities recorded for this package

Search all 8 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Critical Vulnerability in Crossplane: Unexpected Behavior from Is Methods for IPv4-Mapped IPv6 Addresses 9.8 critical 1.15.6 25 Oct 2024
CVE-2023-38495: Image Tampering Vulnerability in Crossplane 8.3 high 1.11.5 28 Jul 2023
CVE-2023-27484: Crossplane-runtime Improper Input Validation via Compositions 6.2 medium 1.9.2 10 Mar 2023
CVE-2023-37900: Denial of Service Vulnerability in crossplane 3.4 low 1.11.5 28 Jul 2023
CVE-2023-38495: Possible image tampering from missing image validation for Packages in github.com/crossplane/crossplane N/A unrated 1.11.5 20 Aug 2024

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/crossplane/crossplane

Is github.com/crossplane/crossplane safe to use?

Vulert records 8 vulnerabilities for github.com/crossplane/crossplane in Go: 1 critical, 1 high, 1 medium and 1 low, plus 4 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/crossplane/crossplane's Vulert package health score?

Vulert scores github.com/crossplane/crossplane 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/crossplane/crossplane affected?

Yes. v1.20.14, the version you would install today, has 6 known vulnerabilities, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/crossplane/crossplane should I use?

v1.21.0-rc.0.0.20250730221455-56f2f81d1329 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/crossplane/crossplane have?

8 vulnerabilities are recorded for github.com/crossplane/crossplane in the Go ecosystem: 1 critical, 1 high, 1 medium and 1 low, plus 4 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/crossplane/crossplane vulnerabilities disclosed?

1 vulnerability was recorded for github.com/crossplane/crossplane in the last 12 months, and the oldest entry in this database dates to 10 Mar 2023. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/crossplane/crossplane are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/crossplane/crossplane for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/crossplane/crossplane version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.