News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-42508 CVE Medium False Positive

ssh/knownhosts: @revoked Status Not Checked on CA SignatureKey

This advisory does not affect KrakenD

KrakenD does not implement or expose SSH functionality. The golang.org/x/crypto/ssh/knownhosts package is a transitive dependency but its code paths are never invoked during KrakenD operation. The dependency was upgraded as a precaution.

Addressed through routine dependency maintenance in CE 2.13.6 and EE 2.13.4.

Component

golang.org/x/crypto (SSH)

Disclosed

May 26, 2026

Description

Go’s golang.org/x/crypto/ssh/knownhosts package does not verify the @revoked status of a certificate authority’s SignatureKey. A certificate issued by a revoked CA may be accepted as valid, allowing an entity whose CA key was revoked to still authenticate successfully.

References

View CVE-2026-42508 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates