docker.io/crossplane/crossplane:v2.3.1
clean
Patched Image
ghcr.io/verity-org/crossplane/crank:v2.3.1
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/crossplane/crank:v2.3.1
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/crossplane/crank:v2.3.1 \ --owner verity-org
Before patching
Found 3 vulnerabilities — none have upstream fixes available.
2 HIGH1 MEDIUM
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-27145HIGH
- Package
- stdlib
- Installed
- v1.25.10
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-42504HIGH
- Package
- stdlib
- Installed
- v1.25.10
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-42507MEDIUM
- Package
- stdlib
- Installed
- v1.25.10
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.25.10
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.25.10
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-27145 | stdlib | v1.25.10 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-42504 | stdlib | v1.25.10 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-42507 | stdlib | v1.25.10 | 1.25.11, 1.26.4 | MEDIUM |
| CVE-2026-39822 | stdlib | v1.25.10 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.25.10 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
Original image reference
docker.io/crossplane/crossplane:v2.3.1