CVE-2026-100351: kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kin-openapito a version that resolves this vulnerability.Fixed in 0.147.0
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using kin-openapi versions 0.144.0 through versions before 0.147.0 are exposed only when ValidationHandler sits in front of a gorilla/mux router configured with UseEncodedPath. The application must also have a public exact route and a protected parameterized route using the same HTTP method that overlap after URL decoding.
What does an attacker need to exploit the issue?
An unauthenticated remote attacker needs to send a request containing an encoded path separator. The encoded path must decode to the public literal route while the router dispatches the raw encoded path to the protected parameterized route.
Does the configured AuthenticationFunc protect the affected request?
No. Under the vulnerable route and router configuration, ValidationHandler can validate the request against the public operation and the downstream router can invoke the protected handler without calling the configured AuthenticationFunc.
Are deployments behind a proxy affected?
A proxy that canonicalizes the URI before forwarding prevents this specific decoded-path versus raw-path mismatch. The issue remains relevant where encoded paths can reach the application without that canonicalization.
What is the available remediation?
Upgrade kin-openapi to version 0.147.0, which fixes the issue. If upgrading cannot happen immediately, prevent encoded-path mismatches from reaching the application, such as by using a proxy that canonicalizes URIs.