CVE-2021-44961

What it actually does

The flaw permits an attacker to influence Crossplane resource provisioning or controller behavior due to insufficient input validation in affected package versions.

Why it matters to the business

Organizations using Crossplane for multi-cloud infrastructure management face risk of unauthorized resource changes or control-plane compromise, potentially leading to cloud resource abuse or data exposure until packages are updated.

How an attack unfolds

An attacker supplies malicious configuration to a Crossplane instance running an affected package version; the controller processes the input without proper sanitization, resulting in unintended actions on the cluster or connected cloud providers.

How to fix it

Upgrade crossplane and crossplane-crank packages to the fixed versions: crossplane (Chainguard) 1.16.0-r2, crossplane (Wolfi) 1.16.0-r2, crossplane-crank (Chainguard) 1.16.0-r2, crossplane-crank (Wolfi) 1.16.0-r2. Reconcile all managed resources after upgrade and audit recent configurations.

How to confirm the fix worked

Verify package versions match or exceed the listed fixed releases using the package manager, then run Crossplane's built-in health and version checks to confirm controllers are using patched binaries.

Typical attack path

1. Identify exposed Crossplane API or configuration endpoints
2. Craft and submit malicious composite resource or claim definitions
3. Trigger controller reconciliation to execute attacker-controlled logic
4. Escalate to cloud provider credentials or cluster admin rights

How to detect it

Search Crossplane controller logs and Kubernetes audit logs for anomalous resource creation events or unexpected provider credential usage around the time of any configuration changes.

What your security team should do

• Immediately update all Crossplane deployments to the specified fixed package versions
• Review and restrict who can submit CompositeResourceDefinitions and Claims
• Enable audit logging for Crossplane controllers and retain for at least 90 days
• Monitor EPSS trend and re-evaluate if exploit maturity increases