RATATOSKRATATOSK
Sign in

Crossplane

v2.4.3Orchestration & Management
Oct 22, 2026

ACTION 4OTHER 2

A security-focused maintenance release updates the Go toolchain and vulnerable dependencies and removes compromised CA roots. It also adds corrective behavior for truncated downloads and expands XR and claim scaling where the XRD serves the scale subresource.

Action needed (4)

  • securityThe Go toolchain at 1.26.10

    The Go toolchain is bumped to 1.26.10; its crypto/x509 rejects the compromised eMudhra intermediate certificates associated with CVE-2026-111943.

  • securityThe AAA Certificate Services and emSign ECC Root CA - G3 roots, removed

    The image's CA bundle removes the AAA Certificate Services and emSign ECC Root CA - G3 roots associated with CVE-2026-111943.

  • securityVulnerable dependency updates

    A combined set of vulnerable dependency updates in pull request #7915 picks up upstream CVE fixes.

  • securityThe Go 1.26.9 build dependency

    The release-2.4 build updates Go to 1.26.9 as a security dependency change in pull request #7951.

    crossplane#7951

All 2 other recorded changesconstraints 1 · value changes 1

constraints (1)

  • Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource; previously they got Forbidden.

value changes (1)

  • Truncated downloads are now discarded. Fixed via crossplane-runtime v2.4.3
Add Crossplane to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Crossplane releases →