News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-27140 CVE Medium · CVSS 5.3 False Positive

cmd/go: Trust Layer Bypass with cgo and SWIG

This advisory does not affect KrakenD

This is a build-time vulnerability in the Go build tool (cmd/go). KrakenD distributes pre-compiled binaries and does not invoke go build at runtime. End users running KrakenD as a gateway are not affected.

Addressed through routine dependency maintenance in CE 2.13.4 and EE 2.13.2.

Component

Go standard library (cmd/go)

Disclosed

Apr 8, 2026

CVSS Score

5.3

Description

Go’s cmd/go build tool trust layer can be bypassed when a project uses both cgo and SWIG together. This may allow untrusted code to be executed at build time during a go build invocation, affecting the security of the resulting binary.
View CVE-2026-27140 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates