KrakenD CE 3.0.2, EE 3.0.2 and EE 2.13.12 Update Released

This patch release of KrakenD Community Edition and Enterprise Edition upgrades Go to 1.26.10, which stops trusting a set of compromised certificate authorities. Upgrade as soon as possible: without it, an attacker can impersonate the services KrakenD connects to or, on mTLS deployments, authenticate against the gateway with a forged client certificate. For 2.x users, Enterprise 2.13.12 backports the same security upgrades.

Compromised eMudhra Intermediate Certificates

The certificate authority eMudhra generated the private keys of eight of its intermediate certificates incorrectly, making them trivially recoverable. Anyone holding those keys can issue certificates that most trust stores accept, for any hostname and for client authentication. The intermediates were revoked on October 18 and 19 and browsers already block them, but Go does not check revocation, so every Go program trusting the affected roots kept accepting them. This is CVE-2026-111943.

Go 1.26.10 adds a denylist to crypto/x509 that rejects any chain going through these intermediates, whatever trust store or CA files you use. In KrakenD, this protects:

• Connections to your services: HTTPS backends, JWK and identity provider URLs, and telemetry exporters. An attacker able to intercept that traffic could read or alter requests, responses and credentials.
• Clients connecting with mTLS: KrakenD trusts the system CA pool alongside your ca_certs unless you set disable_system_ca_pool to true. An attacker could mint a client certificate under a compromised intermediate and pass mTLS authentication without intercepting anything.

If you cannot upgrade immediately, update the CA bundle of the operating system or image running KrakenD, and on mTLS deployments set disable_system_ca_pool to true with an explicit ca_certs list. Both reduce the exposure, but only the upgrade blocks the intermediates regardless of the trust store in use.

Other Security Upgrades

The Enterprise releases also upgrade the openapi dependency, which fixes seven CVEs. Only CVE-2026-100348 affects KrakenD: a crafted OpenAPI document can crash the krakend openapi import and krakend openapi serve commands. The other six live in request and response validation code that KrakenD never uses, so they are false positives. On the Community side, KrakenD CE 3.0.2 upgrades the amqp dependency to address CVE-2026-107386, already fixed in Enterprise in the previous release.

Check our security advisories page for more details on how each CVE affects KrakenD.

Enterprise Improvements

KrakenD EE 3.0.2 makes the AI Gateway more robust against configuration mistakes. Components depending on the AI providers now handle missing or wrong configurations properly, and the semantic cache evaluates vector_dimensions on startup and logs an error when it is misconfigured.

The release also removes irrelevant debug lines from the prompt guard and fixes a panic in the krakend e2e command when you run it with -g 0.

The full list of changes for each version follows.