News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.2, EE 3.0.2 and EE 2.13.12 Update Released News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy
We have implemented KrakenD and I must say that I am very impressed how easy the installation and configuration process has been. The documentation is one of the best I have ever seen.
Märt Suga
Software Architect / Single.Earth
CVE-2026-100348
CVE
Medium
· CVSS 5.3
Low ImpactExploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.
krakend openapi import and krakend openapi serve
commands, which load an OpenAPI document that you pass on the command line. A crafted
document crashes the command instead of returning an error. The gateway runtime never
loads OpenAPI documents, so running krakend run is not affected, and the attack
requires feeding an untrusted specification to the CLI.Component
kin-openapi (openapi3)
Disclosed
Oct 20, 2026
CVSS Score
5.3
kin-openapi 0.145.0, openapi3.Loader can dereference a nil schema value
while resolving an additionalProperties JSON Reference that points to itself.
Loading a crafted OpenAPI document through LoadFromData, LoadFromFile, or
LoadFromURI reaches this code before document validation and panics the loading
process. Ordinary recursive schemas are not affected.Community Edition
Not affected
Enterprise Edition
3.0.2, 2.13.12
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.12 || >= 3.0, < 3.0.2
Upgrade to the addressed version or later to remediate this vulnerability.
Stay up to date with KrakenD releases and important updates