CVE-2026-100351

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.

• CWE-289
• CWE-436

• https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041
• https://github.com/getkin/kin-openapi/releases/tag/v0.147.0
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10034The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable…5.3
• CVE-2026-100347kin-openapi is a Go project for handling OpenAPI files. Prio…5.3
• CVE-2026-100348kin-openapi is a Go project for handling OpenAPI files. Prio…5.3
• CVE-2026-100349kin-openapi is a Go project for handling OpenAPI files. Prio…8.2
• CVE-2026-10035The Turnkey bbPress by WeaverTheme plugin for WordPress is v…6.6
• CVE-2026-100350kin-openapi is a Go project for handling OpenAPI files. From…5.3
• CVE-2026-100352kin-openapi is a Go project for handling OpenAPI files. Prio…7.5
• CVE-2026-100353kin-openapi is a Go project for handling OpenAPI files. From…7.5
• CVE-2026-100354kin-openapi is a Go project for handling OpenAPI files. Prio…7.5
• CVE-2026-100355Campfire is a web-based chat application. In version 1.4.4 a…3.1
• CVE-2026-100358SuiteCRM is an open-source, enterprise-ready Customer Relati…9.4
• CVE-2026-100359SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5