GHSA-gcjh-h69q-9w9g
GHSA
Medium
· CVSS 6.3
False Positivecel-go: JSON-Skipped Struct Fields Exposed via NativeTypes and ParseStructTag
This advisory does not affect KrakenD
The vulnerable code only runs when an application registers Go structs as CEL types
through
ext.NativeTypes. KrakenD never does: the CEL environments of the Community
Edition (validation/cel) and of the Enterprise Security Policies, Prompt Guard, quotas
and tiered rate limits only load the ext.Strings() and ext.Math() extensions, and
expose request and response data as maps, not as native Go structs. No CEL expression in
KrakenD can reach a struct field tagged json:"-".Addressed through routine dependency maintenance in CE 3.0.4 and EE 3.0.4, 2.13.14.
No CVE identifier has been assigned to this vulnerability, so KrakenD tracks it by its GHSA identifier.
Component
cel-go (ext)
Disclosed
Nov 12, 2026
CVSS Score
6.3
Description
GitHub published this advisory for
cel-go without an assigned CVE identifier. When an
application registers Go structs as CEL types with ext.NativeTypes and
ext.ParseStructTag("json"), fields tagged json:"-" are not skipped. They become CEL
fields literally named -, so a user-submitted expression such as dyn(obj)["-"] reads
their value, and they also appear under the - key when the object is converted to JSON.
NativeTypes also registers every nested struct reachable from the registered type, which
can expose secrets in dependency types the developer never reviewed. The advisory lists
0.29.0 as the patched version, but the fix only shipped in cel-go v0.30.0.