News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway
Flexibility, performance and robustness are defining KrakenD just to name a few, we were able to quickly and easily build a robust gateway for our systems and we keep enjoying it everyday.
Samy Lastmann
CTO / Smart Tribune
CVE-2026-39828
CVE
Medium
False Positivegolang.org/x/crypto/ssh package is a transitive dependency but its SSH
authentication code paths are never invoked during KrakenD operation. The
dependency was upgraded as a precaution.Addressed through routine dependency maintenance in CE 2.13.6 and EE 2.13.4.
Component
golang.org/x/crypto (SSH)
Disclosed
May 26, 2026
golang.org/x/crypto/ssh package allows bypass of certificate-based
authentication restrictions when a PartialSuccessError is returned with
non-nil Permissions. An SSH server implementing custom authentication may
inadvertently grant access beyond the certificate’s intended permissions.Stay up to date with KrakenD releases and important updates