News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released
KrakenD allowed us to focus on our backend and deploy a secure and performant system in a few days. After more than 2 years of use in production and 0 crash or malfunction, it also has proven its robustness
Jonathan Muller
CTO / Openroom Inc.
CVE-2026-39831
CVE
Medium
False Positivegolang.org/x/crypto/ssh package is a transitive dependency but its SSH
authentication code paths are never invoked during KrakenD operation. The
dependency was upgraded as a precaution.Addressed through routine dependency maintenance in CE 2.13.6 and EE 2.13.4.
Component
golang.org/x/crypto (SSH)
Disclosed
May 26, 2026
golang.org/x/crypto/ssh client does not check the User Presence flag when
using FIDO/U2F authentication keys. This allows bypassing the physical interaction
requirement for FIDO/U2F keys, potentially enabling authentication without the
required hardware button press.Stay up to date with KrakenD releases and important updates