CVE-2026-97033
CVE
High
False Positivecmd/go: Build-Time Code Execution via sysroot, target and Language cgo Flags
This advisory does not affect KrakenD
This is a build-time vulnerability in the Go toolchain (
cmd/go) that requires
compiling a malicious package. KrakenD distributes pre-compiled binaries and never
invokes the Go toolchain at runtime, so the gateway is not exposed. If you compile
KrakenD Enterprise plugins, build them with the krakend/builder-ee image of version
3.0.4 or 2.13.14, which ships the fixed toolchain.Addressed through routine dependency maintenance in CE 3.0.4 and EE 3.0.4, 2.13.14.
Component
Go toolchain (cmd/go)
Disclosed
Nov 12, 2026
Description
Building a malicious package that uses cgo could execute arbitrary code at build time
through compiler and linker flags allowed in
#cgo directives. --sysroot relocates
compiler subprograms and startup objects to an attacker-controlled directory, Clang’s
-target can run helper tools from the working directory, -isysroot and
-Wl,-syslibroot can pass a file that GNU ld treats as a linker script, and -x accepted
arbitrary input languages. This is a build-time issue in the Go toolchain and does not
affect KrakenD.