OpenAPI Validation Bypass in Kin-OpenAPI by Getkin

CVE-2026-100351

What is CVE-2026-100351?

The kin-openapi project, designed for handling OpenAPI files, has a validation bypass issue in versions 0.144.0 through 0.147.0. When using a downstream gorilla/mux router set with UseEncodedPath, an operation selected from a decoded URL.Path may be incorrectly validated. This flaw occurs when a public route overlaps with a protected parameterized route after decoding, potentially allowing unauthenticated remote requests with encoded path separators to access the protected handler without proper authentication. The problem is particularly concerning for setups where proxies canonicalize the URI, preventing direct detection of this misalignment. The issue has been resolved in kin-openapi version 0.147.0.

References