os: Root.Chmod Follows Symlinks Outside Root on Linux

This CVE does not affect KrakenD

KrakenD does not use Go’s os.Root sandboxed filesystem API at runtime. The vulnerable os.Root.Chmod code path is never invoked during KrakenD operation.

Addressed through routine dependency maintenance in CE 2.13.4 and EE 2.13.2.

Component

Go standard library (os)

Disclosed

Apr 8, 2026

CVSS Score

5.5

Description

Go’s os.Root.Chmod method follows symbolic links that point outside the root directory boundary on Linux, defeating the sandboxing guarantee of the os.Root API. An attacker with the ability to create symlinks inside a sandboxed root and trigger a Chmod call could affect files outside the intended boundary.

View CVE-2026-32282 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates