Flexibility, performance and robustness are defining KrakenD just to name a few, we were able to quickly and easily build a robust gateway for our systems and we keep enjoying it everyday.
Samy Lastmann
CTO / Smart Tribune
GHSA-hrxh-6v49-42gf
GHSA
High
· CVSS 8.8
Medium ImpactThis vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.
KrakenD does not consume xDS, so neither the RBAC authorization bypass nor the xDS policy panic is reachable: no code path builds or evaluates xDS policies.
The HTTP/2 rapid reset bypass is reachable wherever a deployment terminates or
originates gRPC traffic. The Enterprise grpc server accepts HTTP/2 connections from
external clients, which lets an unauthenticated caller flood streams directly. The
backend/grpc client and the OTLP/gRPC exporter of telemetry/opentelemetry reach the
same transport from a malicious or compromised upstream or collector. Deployments that
expose no gRPC server and use no gRPC backend or OTLP/gRPC exporter are not exposed.
No CVE identifier has been assigned to this vulnerability, so KrakenD tracks it by its GHSA identifier.
Component
gRPC for Go (grpc-go)
Disclosed
Jul 15, 2026
CVSS Score
8.8
GitHub published this advisory for grpc-go without an assigned CVE identifier. It
bundles three distinct issues, all fixed in grpc-go 1.82.1.
The xDS RBAC engine silently ignored matcher fields it does not support, such as
Metadata and RequestedServerName. A policy that relies only on those fields to deny
a request therefore admits it, an authorization bypass.
The mitigation for the HTTP/2 rapid reset attack could be bypassed: a client that floods the connection with streams it immediately cancels never crosses the threshold that triggers the defence, so the server keeps allocating and tearing down stream state and burns CPU.
Finally, an xDS policy carrying a NOT rule around a field the engine does not handle
makes the server panic and terminate the process.
Community Edition
2.13.9
addresses this advisory
Affected CE versions
>= 2.0, < 2.13.9
Enterprise Edition
2.13.7
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.7
Upgrade to the addressed version or later to remediate this vulnerability.
Stay up to date with KrakenD releases and important updates