CVE-2026-97035
CVE
High
False Positivecmd/go: Code Execution and Arbitrary File Write via Clang -gen and GCC -gnat cgo Flags
This advisory does not affect KrakenD
This is a build-time vulnerability in the Go toolchain (
cmd/go) that requires
compiling a malicious package. KrakenD distributes pre-compiled binaries and never
invokes the Go toolchain at runtime, so the gateway is not exposed. If you compile
KrakenD Enterprise plugins, build them with the krakend/builder-ee image of version
3.0.4 or 2.13.14, which ships the fixed toolchain.Addressed through routine dependency maintenance in CE 3.0.4 and EE 3.0.4, 2.13.14.
Component
Go toolchain (cmd/go)
Disclosed
Nov 12, 2026
Description
The
-g* wildcard in the cgo flag allowlists also matched Clang’s -gen-cdb-fragment-path
and GCC’s -gnatO, which take a second argument. A malicious package could write files
to arbitrary directories at build time and desynchronize flag parsing so that later
arguments reached the linker as unvalidated inputs, leading to code execution. This is a
build-time issue in the Go toolchain and does not affect KrakenD.