Is CVE-2026-100351 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100351 being exploited in the wild.

How severe is CVE-2026-100351?

High severity, with a CVSS score of 7.4, published 15 October 2026.

Which products and versions are affected?

Getkin Kin-Openapi v0.144.0, v0.145.0, v0.146.0; affected range likely extends to current, introduced version unknown; github.com/getkin/kin-openapi (Go) >= 0.144.0, < 0.147.0, SEMVER:introduced=0.144.0,fixed=0.147.0.

How is CVE-2026-100351 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100351?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100351: kin-openapi SecurityHandler authentication bypass via path encoding

Q: Is there a fix for CVE-2026-100351?

Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.147.0 or later. Until then: Supply a custom router to `ValidationHandler` that matches the downstream router's path semantics, or ensure the downstream router does not use `UseEncodedPath()` so both the validation and dispatch layers select the same operation from the same path representation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-100351 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-100351?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100351 · Severity: high · CVSS 7.4 · Published 2026-10-15

kin-openapi is a Go library that validates HTTP requests against OpenAPI specifications and enforces security policies like authentication. An attacker can bypass authentication on protected API endpoints by sending requests with URL-encoded path separators (e.g., `/public%2Fstatus`), causing the validation layer to check one route while the application router dispatches a different protected route. This allows unauthenticated access to handlers that should require credentials when certain routing configurations are used.

Technologies: Getkin Kin-Openapi, github.com/getkin/kin-openapi (Go). Vendors: Getkin, Go.

Quick answers

Is CVE-2026-100351 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100351 being exploited in the wild.
How severe is CVE-2026-100351?: High severity, with a CVSS score of 7.4, published 15 October 2026.
Which products and versions are affected?: Getkin Kin-Openapi v0.144.0, v0.145.0, v0.146.0; affected range likely extends to current, introduced version unknown; github.com/getkin/kin-openapi (Go) >= 0.144.0, < 0.147.0, SEMVER:introduced=0.144.0,fixed=0.147.0.
Is there a fix for CVE-2026-100351?: Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.147.0 or later. Until then: Supply a custom router to `ValidationHandler` that matches the downstream router's path semantics, or ensure the downstream router does not use `UseEncodedPath()` so both the validation and dispatch layers select the same operation from the same path representation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100351 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100351?: Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/getkin/kin-openapi (Go): upgrade to 0.147.0 or later
```
go get github.com/getkin/kin-openapi@v0.147.0
```

Supply a custom router to `ValidationHandler` that matches the downstream router's path semantics, or ensure the downstream router does not use `UseEncodedPath()` so both the validation and dispatch layers select the same operation from the same path representation.

Technical details

The vulnerability exists in `openapi3filter.ValidationHandler.Middleware`, which selects operations using the decoded request path while downstream routers configured with `UseEncodedPath()` (like gorilla/mux) select handlers from the encoded path representation. By crafting a request where an encoded path decodes to a public route but matches a protected parameterized route in the router's encoded interpretation, an attacker can reach protected handlers with the authentication callback never being invoked. Exploitation requires the downstream router to preserve encoded paths, overlapping public and protected routes, and reliance on the validation layer for security decisions.

Affected products

getkin kin-openapi v0.144.0, v0.145.0, v0.146.0; affected range likely extends to current, introduced version unknown

Identifiers

CVE-2026-100351
GHSA-23vg-4cjm-66q5
GO-2026-6769

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.