News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-27142 CVE Medium · CVSS 5.3 False Positive

html/template: URLs in Meta Content Attribute Not Escaped

This advisory does not affect KrakenD

KrakenD is an API gateway and does not use Go’s html/template package to generate HTML responses. The vulnerable code path in the html/template package is never invoked during normal KrakenD operation.

Addressed through routine dependency maintenance in CE 2.13.2 and EE 2.13.0.

Component

Go standard library (html/template)

Disclosed

Mar 9, 2026

CVSS Score

5.3

Description

Go’s html/template package fails to properly escape URLs used in content attribute values within <meta> HTML tags when those values are produced by template actions. An attacker controlling the input to such a template can inject arbitrary URLs or JavaScript pseudo-protocol handlers into the rendered HTML.
View CVE-2026-27142 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates