CVE-2026-3206
Improper Resource Release in KrakenD CircuitBreaker Modules
Publication date: 2026-02-25
Last updated on: 2026-02-25
Assigner: KrakenD, S.L.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| krakend | krakend-ce | to 2.13.1 (exc) |
| krakend | krakend-ee | to 2.13.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3206 is an Improper Resource Shutdown or Release vulnerability found in the CircuitBreaker modules of KrakenD Community Edition (CE) and Enterprise Edition (EE). This issue affects KrakenD-CE versions before 2.13.1 and KrakenD-EE versions before 2.13.0. It relates to how resources are managed and released within the Circuit Breaker component of the KrakenD API Gateway.
How can this vulnerability impact me? :
This vulnerability can impact the reliability and security of the Circuit Breaker mechanism in KrakenD. Improper resource shutdown or release may lead to resource leaks or unstable behavior in the API Gateway, potentially causing degraded service performance or unexpected failures.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The KrakenD 2.13.1 release includes new audit command rules that help detect issues related to the Circuit Breaker component, which is affected by CVE-2026-3206.
Users can utilize these audit commands introduced in the 2.13.1 update to identify potential vulnerabilities or misconfigurations in their KrakenD Circuit Breaker modules.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2026-3206, users should upgrade KrakenD Community Edition to version 2.13.1 or later, and KrakenD Enterprise Edition to version 2.13.0 or later.
This upgrade addresses the security issue in the Circuit Breaker modules and improves the reliability and security of the component.