cmd/go: CgoPkgConfig Flag Bypass Leads to Arbitrary Code Execution

This CVE does not affect KrakenD

This is a build-time vulnerability in the Go build tool (cmd/go). KrakenD distributes pre-compiled binaries and does not invoke go build at runtime. End users running KrakenD as a gateway are not affected.

Addressed through routine dependency maintenance in CE 2.12.1 and EE 2.12.3.

Component

Go standard library (cmd/go)

Disclosed

Jan 16, 2026

CVSS Score

7.5

Description

Go’s build tool honours #cgo pkg-config: directives inside Go source files to pass flags to the underlying C compiler and linker. Insufficient sanitisation of these directives allows an attacker who can contribute Go source to a cgo-enabled project to inject arbitrary compiler or linker flags, potentially enabling arbitrary code execution during the build.

References

View CVE-2025-61731 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates