CVE-2026-97037
CVE
High
False Positivecmd/go: Linker Script Injection via Split -Wl Flags in cgo
This advisory does not affect KrakenD
This is a build-time vulnerability in the Go toolchain (
cmd/go) that requires
compiling a malicious package. KrakenD distributes pre-compiled binaries and never
invokes the Go toolchain at runtime, so the gateway is not exposed. If you compile
KrakenD Enterprise plugins, build them with the krakend/builder-ee image of version
3.0.4 or 2.13.14, which ships the fixed toolchain.Addressed through routine dependency maintenance in CE 3.0.4 and EE 3.0.4, 2.13.14.
Component
Go toolchain (cmd/go)
Disclosed
Nov 12, 2026
Description
Split
-Wl, flags that consume a following argument, such as -Wl,-rpath or
-Wl,--just-symbols, accepted a bare second argument that the compiler driver passes to
the linker as an input file. Together with several macOS and symbol flags that GNU ld
interprets as linker scripts when they name a regular file, a malicious package could
run arbitrary code at link time. This is a build-time issue in the Go toolchain and does
not affect KrakenD.