News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway
KrakenD played a vital role in our API transformation journey by protecting our business platforms boundary and exposing the business capabilities in a standard way to both internal and external audience.
Stefano Leopizzi
Enterprise Architecture / lastminute.com
CVE-2025-4674
CVE
High
· CVSS 8.6
False Positivego build command when processing VCS repositories
with mixed version control metadata. KrakenD never runs the Go toolchain at runtime —
cmd/go is a build-time tool only. A running KrakenD deployment cannot trigger this
code path.Addressed through routine dependency maintenance in CE 2.10.2 and EE 2.10.3.
Component
Go toolchain (cmd/go)
Disclosed
Jul 9, 2025
CVSS Score
8.6
go command may execute unexpected commands when operating on repositories
that contain metadata for multiple version control systems — for example, a Git
repository that also contains Mercurial configuration. An attacker who can influence
the repository contents during a build could trigger execution of arbitrary VCS
commands. Modules retrieved via standard go get are not affected.
KrakenD never invokes the Go toolchain at runtime, so a running deployment cannot
be exploited through this vulnerability.Stay up to date with KrakenD releases and important updates