# CVE-2026-100351: kin-openapi SecurityHandler authentication bypass via path encoding

Source: https://junglewise.ai/threats/cve-2026-100351-kin-openapi-validationhandler-security-requirement-bypass-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-100351 · Severity: high · CVSS 7.4 · Published 2026-10-15

kin-openapi is a Go library that validates HTTP requests against OpenAPI specifications and enforces security policies like authentication. An attacker can bypass authentication on protected API endpoints by sending requests with URL-encoded path separators (e.g., `/public%2Fstatus`), causing the validation layer to check one route while the application router dispatches a different protected route. This allows unauthenticated access to handlers that should require credentials when certain routing configurations are used.

Technologies: [Getkin Kin-Openapi](https://junglewise.ai/threats/technologies/kin-openapi), [github.com/getkin/kin-openapi (Go)](https://junglewise.ai/threats/technologies/github-com-getkin-kin-openapi). Vendors: [Getkin](https://junglewise.ai/threats/vendors/getkin), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-100351 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100351 being exploited in the wild.

**How severe is CVE-2026-100351?** High severity, with a CVSS score of 7.4, published 15 October 2026.

**Which products and versions are affected?** Getkin Kin-Openapi v0.144.0, v0.145.0, v0.146.0; affected range likely extends to current, introduced version unknown; github.com/getkin/kin-openapi (Go) >= 0.144.0, < 0.147.0, SEMVER:introduced=0.144.0,fixed=0.147.0.

**Is there a fix for CVE-2026-100351?** Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.147.0 or later. Until then: Supply a custom router to `ValidationHandler` that matches the downstream router's path semantics, or ensure the downstream router does not use `UseEncodedPath()` so both the validation and dispatch layers select the same operation from the same path representation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100351 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100351?** Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/getkin/kin-openapi (Go): upgrade to 0.147.0 or later

  ```sh
  go get github.com/getkin/kin-openapi@v0.147.0
  ```


Supply a custom router to `ValidationHandler` that matches the downstream router's path semantics, or ensure the downstream router does not use `UseEncodedPath()` so both the validation and dispatch layers select the same operation from the same path representation.

## Technical details

The vulnerability exists in `openapi3filter.ValidationHandler.Middleware`, which selects operations using the decoded request path while downstream routers configured with `UseEncodedPath()` (like gorilla/mux) select handlers from the encoded path representation. By crafting a request where an encoded path decodes to a public route but matches a protected parameterized route in the router's encoded interpretation, an attacker can reach protected handlers with the authentication callback never being invoked. Exploitation requires the downstream router to preserve encoded paths, overlapping public and protected routes, and reliance on the validation layer for security decisions.

## Affected products

- getkin kin-openapi v0.144.0, v0.145.0, v0.146.0; affected range likely extends to current, introduced version unknown

## Identifiers

- CVE-2026-100351
- GHSA-23vg-4cjm-66q5
- GO-2026-6769

## Timeline

- 2026-10-15: disclosed

## Related threats

- [kin-openapi uncontrolled recursion on circular allOf/anyOf/oneOf schemas](https://junglewise.ai/threats/cve-2026-100354-kin-openapi-uncontrolled-recursion-on-circular-allof-anyof-oneof)
- [kin-openapi deepObject query decoding DoS via repeated regexp compilation](https://junglewise.ai/threats/cve-2026-100350-kin-openapi-deepobject-query-decoding-repeatedly-compiles-an)
- [kin-openapi OpenAPI spec loader nil-pointer panic on self-referential additionalProperties](https://junglewise.ai/threats/cve-2026-100348-kin-openapi-spec-loader-panics-on-a-self-referential)
- [kin-openapi: Unauthenticated denial of service in legacy router](https://junglewise.ai/threats/cve-2026-100347-kin-openapi-unauthenticated-panic-dos-in-openapi3filter-legacy)
- [kin-openapi nil pointer dereference in query/body array decoding](https://junglewise.ai/threats/cve-2026-100353-kin-openapi-incomplete-fix-for-ghsa-p6wj-qrr4-pgh5-three)