CVE-2026-39828
Medium
False Positivegolang.org/x/crypto/ssh package is a transitive dependency but its SSH
authentication code paths are never invoked during KrakenD operation. The
dependency was upgraded as a precaution.Addressed through routine dependency maintenance in CE 2.13.6 and EE 2.13.4.
Component
golang.org/x/crypto (SSH)
Disclosed
May 26, 2026
golang.org/x/crypto/ssh package allows bypass of certificate-based
authentication restrictions when a PartialSuccessError is returned with
non-nil Permissions. An SSH server implementing custom authentication may
inadvertently grant access beyond the certificate’s intended permissions.Stay up to date with KrakenD releases and important updates