News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.2, EE 3.0.2 and EE 2.13.12 Update Released News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy
KrakenD allowed us to focus on our backend and deploy a secure and performant system in a few days. After more than 2 years of use in production and 0 crash or malfunction, it also has proven its robustness
Jonathan Muller
CTO / Openroom Inc.
CVE-2026-100353
CVE
High
· CVSS 7.5
False Positiveopenapi3filter request decoders. KrakenD Enterprise uses
kin-openapi only to load and translate OpenAPI documents in the krakend openapi
commands and never validates incoming requests against an OpenAPI specification, so
the decoders are never invoked. KrakenD Community does not include kin-openapi.Addressed through routine dependency maintenance in EE 3.0.2, 2.13.12.
Component
kin-openapi (openapi3filter)
Disclosed
Oct 20, 2026
CVSS Score
7.5
openapi3filter decoder paths missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a
nil items guard for legal OpenAPI 3.1 array schemas. An unauthenticated client
triggers a deterministic nil pointer panic through an array query parameter, a
deepObject query parameter containing an array property, or a form-encoded body whose
array property appears inside an allOf, anyOf, or oneOf subschema. Affects
kin-openapi 0.136.0 to 0.148.x and is fixed in 0.149.0.Stay up to date with KrakenD releases and important updates