News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway
We began by creating a model with the community version to assess its capabilities. Once we confirmed that this tool met our needs, we opted for an enterprise license. Simply to benefit from tools that facilitate integration into our model and address specific requirements of our architecture in terms of security, data transformation, and authentication management.
Nicolas Gabetty
Senior Engineer / Coop Atlantique
CVE-2026-94447
CVE
Medium
False Positivego command line tool (cmd/go)
while downloading toolchains. KrakenD’s compiled binary never invokes the Go
toolchain or fetches modules at runtime.Addressed through routine dependency maintenance in CE 3.0.1 and EE 3.0.1, 2.13.11.
Component
Go toolchain (cmd/go)
Disclosed
Oct 13, 2026
go.sum entry for golang.org/toolchain,
combined with a malicious GOPROXY, could make the go command skip the checksum
database check when downloading a toolchain, so an untrusted toolchain could be used.
The fix always fetches the canonical toolchain checksum from the network. This is a
build-time issue in the Go toolchain and does not affect KrakenD.Stay up to date with KrakenD releases and important updates