Context

Users of the github.com/crossplane/crossplane Go module on the v1.20 line may encounter security scanner alerts for GHSA-wfqx-gjrf-g28r. This advisory describes a vulnerability in Crossplane's package manager where signature verification can be bypassed if packages are installed by tag rather than digest from an untrusted registry. The fix has been shipped in v2.2.3 and v2.3.3, but not backported to the v1.20 line.

Customers who cannot upgrade to v2 within their CVE remediation window may wonder whether this finding applies to their usage and whether a backport to v1.20 is planned.

Answer

Whether this finding applies to your usage depends on what you import from the module.

The vulnerability is entirely specific to Crossplane's package manager functionality. It requires all three of the following conditions to hold simultaneously:

1. Cosign signature verification is configured.

2. Packages are installed by tag rather than by digest.

3. Packages are pulled from a registry you do not control.

Critically, all affected code resides under the module's internal/ directory. Go's internal package rule means this code cannot be imported by external modules. If your usage is limited to consuming API types (for example, using apis/apiextensions/v1alpha1 to register Crossplane types into your scheme), there is no path from your code to the affected code — the compiler does not permit such an import. In this case, the finding does not apply to your usage.

Will the fix be backported to v1.20?

No. The Crossplane maintainers have confirmed that this fix will not be applied to the v1.20 line. Two reasons are given in the upstream advisory:

1. The finding is only relevant when an alpha feature is enabled and configured, and a reasonable mitigation (already a security best practice) exists.

2. Applying the fix to v1.20 would require bringing across the substantial package manager refactor that shipped in Crossplane v2.2, which was judged an unnecessary risk given that v1.20 receives only critical fixes.

This position is documented in the upstream advisory. Note that the GitHub-managed record at github.com/advisories/... may not update automatically — refer to the upstream Crossplane advisory for the authoritative "Note on Fixed Versions" section.

What is the support status of v1.20?

v1.20 is currently supported and is the only remaining supported release on the v1 line. The most recent patch release is v1.20.11. However, support is limited in scope: v1.20 receives only critical fixes; new features and non-critical bug fixes are not backported. There is no announced end-of-life date for v1.20 at this time.

Recommendation: Plan an upgrade to v2 as a priority. Upgrading the control plane to v2 does not require migrating your existing XRs or resources, and backward compatibility covers existing workloads. Crossplane provides a readiness checker to help identify any usage of breaking changes before upgrading: https://blog.crossplane.io/v2-upgrade-check/.