News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-56857 CVE Critical · CVSS 9.8 False Positive

os: Root.MkdirAll Follows Junctions Out of the Root on Windows

This advisory does not affect KrakenD

KrakenD does not use the sandboxed os.Root filesystem API, and the flaw is specific to Windows junctions. The vulnerable code path is never reached in a KrakenD deployment.

Addressed through routine dependency maintenance in CE 3.0.1 and EE 3.0.1, 2.13.11.

Component

Go standard library (os)

Disclosed

Oct 13, 2026

CVSS Score

9.8

Description

On Windows, os.Root.Mkdir and os.Root.MkdirAll could create a directory outside the root when the final path component was a junction pointing to a nonexistent location. Code that relies on os.Root to confine filesystem writes to a directory could therefore be made to create directories elsewhere on the system. The fix stops resolving junctions. This does not affect KrakenD.

References

View CVE-2026-56857 on Go Issue Tracker View CVE-2026-56857 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates