News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-94444 CVE Medium False Positive

cmd/go: Checksum Bypass for golang.org/fips140 via Malicious Module Proxy

This advisory does not affect KrakenD

The vulnerable code path only runs inside the go command line tool (cmd/go) while resolving modules. KrakenD’s compiled binary never invokes the Go toolchain or fetches modules at runtime.

Addressed through routine dependency maintenance in CE 3.0.1 and EE 3.0.1, 2.13.11.

Component

Go toolchain (cmd/go)

Disclosed

Oct 13, 2026

Description

A malicious project that defines its own golang.org/fips140 module, combined with a malicious GOPROXY, could make the go command use an arbitrary module in place of the FIPS 140 module bundled with the toolchain, bypassing checksum verification. The fix verifies the bundled module against its trusted hash. This is a build-time issue in the Go toolchain and does not affect KrakenD.

References

View CVE-2026-94444 on Go Issue Tracker View CVE-2026-94444 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates