Findings

CVE-2026-100351

kin-openapi is a Go project for handling OpenAPI files.

Published Oct 15, 2026 · updated Oct 15, 2026

## Summary validates requests with kin-openapi's legacy router, which selects an OpenAPI operation from the decoded . The method is documented as implementing , but a downstream gorilla/mux router configured with selects its handler from the encoded representation ( ). An unauthenticated request such as can therefore be validated as an intentionally public operation ( ) and then dispatched to a protected operation ( ). The configured, rejecting is never invoked, and the protected downstream handler runs. This is distinct from GHSA-r277-6w6q-xmqw. The behavior below uses an explicit authentication callback that rejects missing credentials and remains reproducible after the v0.144.0 fix for the unsafe default callback. ## Affected products - Product: - Component: - Confirmed post-GHSA affected releases: v0.144.0, v0.145.0, and v0.146.0 - Reporter attestation: each listed release was checked out separately, the attached single-file test was copied into , and that test passed; maintainers should independently confirm the version range - Confirmed affected development revision: - v0.143.0 also reproduces this mechanism, but GHSA-r277-6w6q-xmqw already provides a simpler bypass on that release; the distinct post-fix claim starts at v0.144.0 - Earlier releases: not tested; please treat the introduction boundary as unknown ## Security impact An unauthenticated remote requester can reach a handler whose OpenAPI operation requires authentication when all of the following are true: 1. the application uses as the security gate; 2. the downstream router preserves and interprets an encoded path, such as gorilla/mux with ; 3. a public exact route and a protected parameterized route overlap after decoding; 4. the public and protected operations expose the same HTTP method; 5. the protected handler relies on the validation layer's security decision. The protected operation's path-parameter value is constrained: it is an encoded representation that decodes to a public literal path (