News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released
We began by creating a model with the community version to assess its capabilities. Once we confirmed that this tool met our needs, we opted for an enterprise license. Simply to benefit from tools that facilitate integration into our model and address specific requirements of our architecture in terms of security, data transformation, and authentication management.
Nicolas Gabetty
Senior Engineer / Coop Atlantique
CVE-2026-24051
CVE
High
· CVSS 7
Low ImpactExploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.
telemetry/opentelemetry present in the KrakenD configuration) running on macOS.
Linux deployments are not affected. Exploitation also requires local system access and
the ability to manipulate the $PATH environment variable.Component
telemetry/opentelemetry
Disclosed
Mar 9, 2026
CVSS Score
7
ioreg system command
using an unsecured search path on macOS/Darwin. An attacker with local access who can
manipulate the $PATH environment variable can substitute a malicious binary and
achieve arbitrary code execution. Affects OpenTelemetry-Go SDK versions 1.20.0 through
1.39.0; fixed in 1.40.0.Community Edition
2.13.2
addresses this advisory
Affected CE versions
>= 2.0, < 2.13.2
Enterprise Edition
2.13.0
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.0
Upgrade to the addressed version or later to remediate this vulnerability.
Stay up to date with KrakenD releases and important updates