KrakenD CE 3.0.3, EE 3.0.3 and EE 2.13.13 Update Released

This patch release of KrakenD Community Edition and Enterprise Edition upgrades the Go JOSE library behind the JWT validator, and fixes a potential authentication bypass that affects the Community Edition only. We recommend upgrading if any of your endpoints use auth/validator. For 2.x users, Enterprise 2.13.13 backports the same security upgrades.

JWK Cache Collision in the Community JWT Validator

The auth/validator component caches the JSON Web Keys (JWK) it retrieves from your identity providers. In KrakenD CE, under certain misconfigurations, two cached keys could collide, and KrakenD could validate a token against a key that did not belong to the endpoint’s identity provider. An attacker able to exploit that collision could get a token accepted where it should have been rejected, bypassing authentication.

KrakenD CE 3.0.3 fixes the collision. The Enterprise Edition was not affected. Big kudos to Yonghwa Lee (Xint by Theori) and Javier García Herrera for finding and responsibly reporting this issue.

Go JOSE Upgrades in the JWT Validator

The releases also upgrade Go JOSE, the library behind auth/validator, to fix three CVEs. Two of them affect KrakenD, and both are reachable before the signature check, so an attacker does not need a valid token:

• CVE-2026-116587: a token that embeds a JWK with huge RSA primes makes key validation burn an excessive amount of CPU.
• CVE-2026-116586: a token with deeply nested JSON can exhaust the stack and crash the KrakenD process.

The third one, CVE-2026-116585, is a panic when decrypting JWE tokens with CBC-HMAC algorithms. auth/validator only handles signed tokens and never decrypts JWE, so it is a false positive.

Other Security Upgrades

All three releases upgrade the x/net dependency, addressing CVE-2026-78661 and CVE-2026-97045. Both live in the HTML parser and renderer, which KrakenD never uses, so they are false positives.

Check our security advisories page for more details on how each CVE affects KrakenD.

Telemetry and Enterprise Fixes

OpenTelemetry static attributes now override the HTTP server and port attributes that KrakenD computes, so the values you declare are the ones your observability backend receives.

KrakenD EE 3.0.3 also fixes shared_cache_duration, which now properly enables the shared JWK cache, and makes the log entries related to the plugins on_load_error reflect the actual error.

The full list of changes for each version follows.