CVE-2026-100351 in kin-openapi
Summary
by MITRE • 10/15/2026
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The kin-openapi library serves as a critical component for Go-based applications requiring OpenAPI specification handling, particularly within microservices architectures where API gateways and routing logic are tightly coupled with validation mechanisms. A significant security vulnerability was identified in versions ranging from 0.144.0 to 0.147.0 of the openapi3filter package, specifically affecting the ValidationHandler component. This flaw stems from a fundamental inconsistency between how URL paths are decoded for OpenAPI specification matching and how they are processed by downstream HTTP routers like gorilla/mux when configured with specific encoding behaviors. The core issue lies in the divergence between the canonicalized path used for validation against the API definition and the raw, potentially encoded path used for actual request dispatching.
In a typical secure implementation, an authentication middleware or handler should validate credentials before any business logic is executed. However, this vulnerability allows an attacker to bypass such checks through a technique known as HTTP parameter pollution via URL encoding manipulation. When gorilla/mux is configured with UseEncodedPath set to true, it prioritizes the RawPath field of the request over the decoded Path for route matching. Conversely, kin-openapi’s ValidationHandler operates on the decoded version of the URL path to determine which operation from the OpenAPI specification applies to the incoming request. This creates a window where the validation layer and the routing layer disagree on the identity of the requested resource.
The exploitation scenario requires a specific configuration overlap: an exact public route that does not require authentication must share the same HTTP method with a parameterized protected route that does require authentication, such as /users/{id}. If these routes are defined in a way that their decoded paths could theoretically match or if the router’s logic allows for ambiguity resolution based on encoded characters, an attacker can craft a request using percent-encoded path separators. For instance, instead of requesting /protected/resource/123, an attacker might send /protected%2Fresource/123. The kin-openapi library decodes this to /protected/resource/123 and validates it against the public exact route definition, deeming the request valid for that unauthenticated endpoint. Simultaneously, gorilla/mux with UseEncodedPath interprets the RawPath as distinct or matches it differently based on its own routing rules, potentially dispatching the request to a protected handler associated with a different path structure.
This mismatch results in an authentication bypass where the request is validated against public security policies but executed under the context of a protected endpoint that expects higher privilege levels. The AuthenticationFunc configured for the application is effectively skipped because the validation layer has already approved the request based on its interpretation of the decoded URL, while the router executes logic intended for authenticated users. This constitutes a critical authorization bypass vulnerability, allowing unauthenticated remote actors to access sensitive data or perform privileged actions that should be restricted.
From an industry standards perspective, this flaw aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site. It also maps to MITRE ATT&CK techniques related to Path Traversal and potentially T1530 Data from Information Repositories if sensitive data is exposed through the bypassed protected endpoints. The vulnerability highlights the dangers of relying on implicit assumptions about path canonicalization across different layers of a web stack, particularly when dealing with non-standard or encoded URL components that deviate from standard URI syntax rules enforced by most proxies and browsers.
Mitigation strategies primarily involve upgrading to version 0.147.0 or later where this discrepancy has been addressed. Developers should ensure that their OpenAPI validation layers operate on the same path representation as their HTTP routers, preferably using canonicalized paths for both validation and routing decisions. Additionally, configuring gorilla/mux without UseEncodedPath can prevent certain classes of encoding-based bypasses, although relying solely on router configuration is insufficient if the underlying library logic remains flawed. Organizations should also implement strict input validation at the gateway level to reject requests containing encoded path separators that do not conform to expected URI structures, thereby adding a defense-in-depth layer against such manipulation techniques.