News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-27139 CVE Medium · CVSS 6.5 Low Impact

os: FileInfo Can Escape from a Root

Limited exploitability

Exploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.

KrakenD does not expose os.Root-based file traversal operations to incoming API requests. File access through this code path occurs only during startup (configuration loading) and is not reachable via external request inputs during normal operation.

Component

Go standard library (os)

Disclosed

Mar 9, 2026

CVSS Score

6.5

Description

A path traversal issue in Go’s os package allows a FileInfo value obtained through os.Root methods to reference paths that escape the intended sandbox root boundary. An attacker able to influence file path operations within a sandboxed root could access or observe files outside the sandbox.

Version summary

Community Edition

2.13.2

addresses this advisory

Affected CE versions

>= 2.0, < 2.13.2

Enterprise Edition

2.13.0

addresses this advisory

Affected EE versions

>= 2.0, < 2.13.0

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-27139 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates