News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.4, EE 3.0.4 and EE 2.13.14 Update Released News What Is an AI Gateway? Architecture, Controls and Use Cases News KrakenD CE 3.0.3, EE 3.0.3 and EE 2.13.13 Update Released

CVE-2026-97036 CVE High False Positive

cmd/go: Code Execution on macOS via -l to_library in cgo LDFLAGS

This advisory does not affect KrakenD

This is a build-time vulnerability in the Go toolchain (cmd/go) that requires compiling a malicious package. KrakenD distributes pre-compiled binaries and never invokes the Go toolchain at runtime, so the gateway is not exposed. If you compile KrakenD Enterprise plugins, build them with the krakend/builder-ee image of version 3.0.4 or 2.13.14, which ships the fixed toolchain.

Addressed through routine dependency maintenance in CE 3.0.4 and EE 3.0.4, 2.13.14.

Component

Go toolchain (cmd/go)

Disclosed

Nov 12, 2026

Description

On macOS, a malicious package could pass -l to_library <path> in #cgo LDFLAGS. The Apple linker recombines both arguments into -lto_library, which loads an arbitrary LTO plugin library at link time and runs its code. This is a build-time issue in the Go toolchain and does not affect KrakenD.

References

View CVE-2026-97036 on Go Issue Tracker View CVE-2026-97036 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates