getkin kin-openapi up to 0.146.x Validation openapi3filter.ValidationHandler access control

Summaryinfo

A vulnerability was found in getkin kin-openapi up to 0.146.x. It has been rated as critical. Affected by this issue is the function openapi3filter.ValidationHandler of the component Validation Handler. The manipulation leads to access control. This vulnerability is uniquely identified as CVE-2026-100351. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in getkin kin-openapi up to 0.146.x. This issue affects the function openapi3filter.ValidationHandler of the component Validation Handler. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-100351 since 09/25/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 0.147.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-102160). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• getkin

Name

• kin-openapi

Version

• 0.146

Website

• Product: https://github.com/getkin/kin-openapi/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion