CVE-2026-100351 · GHSA-23vg-4cjm-66q5
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
- Risk score
- 63/100
- CVSS
- 7.4 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exa…
- Affected
- github.com/getkin/kin-openapi (go) >= 0.144.0, < 0.147.0
- Fix
- Upgrade github.com/getkin/kin-openapi to 0.147.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
github.com/getkin/kin-openapi: Amber, patch this week. kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or respons…
The flaws
- CVE-2026-100351: Kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion (CVSS 7.4 · EPSS 0%)
- CVE-2026-100354: Kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash (CVSS 7.5 · EPSS 0%)
- CVE-2026-100352: Kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path (CVSS 7.5 · EPSS 0%)
- CVE-2026-100349: Kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content (CVSS 8.2 · EPSS 0%)
The fix
Upgrade github.com/getkin/kin-openapi: 0.147.0 · 0.149.0 · 0.148.0 · 0.146.0 or later on your release line
Who is exposed: github.com/getkin/kin-openapi (go) < 0.149.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-289 (CWE-289). 3 other warnings in 30 days
Why it is Amber
- CVSS 7.4 high
- Remotely exploitable without logging in
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/getkin/kin-openapi | go | >= 0.144.0, < 0.147.0 | 0.147.0 |
References
- https://github.com/advisories/GHSA-23vg-4cjm-66q5
- https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5
- https://nvd.nist.gov/vuln/detail/CVE-2026-100351
- https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041
- https://github.com/getkin/kin-openapi/releases/tag/v0.147.0
- https://github.com/advisories/GHSA-23vg-4cjm-66q5
Original description
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.
Last activity 15 Oct 2026. Patch Forecast updates every hour.