News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-32282 CVE Medium · CVSS 5.5 False Positive

os: Root.Chmod Follows Symlinks Outside Root on Linux

This advisory does not affect KrakenD

KrakenD does not use Go’s os.Root sandboxed filesystem API at runtime. The vulnerable os.Root.Chmod code path is never invoked during KrakenD operation.

Addressed through routine dependency maintenance in CE 2.13.4 and EE 2.13.2.

Component

Go standard library (os)

Disclosed

Apr 8, 2026

CVSS Score

5.5

Description

Go’s os.Root.Chmod method follows symbolic links that point outside the root directory boundary on Linux, defeating the sandboxing guarantee of the os.Root API. An attacker with the ability to create symlinks inside a sandboxed root and trigger a Chmod call could affect files outside the intended boundary.
View CVE-2026-32282 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates