CVE-2026-100351: 
Wolfi vulnerability analysis and mitigation

CVE-2026-100351 is an authentication bypass vulnerability in kin-openapi (Go module github.com/getkin/kin-openapi), a Go library for handling OpenAPI files. The flaw exists in openapi3filter.ValidationHandler.Middleware, which validates requests using a legacy router operating on the decoded URL.Path, while a downstream gorilla/mux router configured with UseEncodedPath() dispatches based on the raw encoded URL.RawPath. This mismatch allows an unauthenticated attacker to craft a request with a percent-encoded path separator (e.g., /public%2Fstatus) that is validated as a public operation but dispatched to a protected handler — entirely bypassing the configured AuthenticationFunc. Affected versions are v0.144.0 through v0.146.0 (inclusive); the issue is fixed in v0.147.0. It carries a CVSS v3.1 base score of 7.4 (High) (Github Advisory, GHSA Advisory).

The root cause is a dual-router interpretation conflict (CWE-436) combined with authentication bypass by alternate name (CWE-289). ValidationHandler.Load unconditionally constructs a legacy router (routers/legacy.NewRouter) that selects OpenAPI operations from the decoded URL.Path, while the downstream gorilla/mux router with UseEncodedPath() selects handlers from URL.RawPath. When a public exact route (e.g., /public/status) and a protected parameterized route (e.g., /{id}) share the same HTTP method and overlap after URL decoding, a request to /public%2Fstatus is matched by the legacy router to the public operation (no auth required), but gorilla/mux matches it to the protected /{id} handler with id=public%2Fstatus. The AuthenticationFunc is never invoked because the validation layer already approved the request as public, and ValidationHandler.Middleware forwards the unchanged request to the downstream handler. A self-contained Go test (encoded_path_route_confusion_test.go) demonstrating the bypass is included in the fix commit and the advisory (GHSA Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to invoke protected API handlers without valid credentials, bypassing the application's entire authentication gate. The confidentiality and integrity impact depends on what the reachable protected handler exposes — potential consequences include unauthorized data access or unauthorized state modification. Availability is not impacted by this vulnerability. The attack is constrained in that the path parameter value is limited to an encoded form that decodes to the public route literal (e.g., public%2Fstatus), so arbitrary protected endpoints are not universally reachable — only those whose parameterized path overlaps with a public exact route after decoding (GHSA Advisory, Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory (GHSA-23vg-4cjm-66q5), including a self-contained Go test file with concrete reproduction steps and expected output (status=202 downstream_route=/{id} protected_id=public%2Fstatus authentication_calls=0). The advisory was published on August 18, 2026, and the CVE was assigned and published to NVD on October 15, 2026. The exploit has been classified as poc by NVD SSVC, with no evidence of active in-the-wild exploitation at the time of publication. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is not automatable due to the specific preconditions required (matching route overlap, gorilla/mux with UseEncodedPath(), and ValidationHandler.Middleware as the security gate) (GHSA Advisory, Github Advisory).

1. Reconnaissance: Identify applications using github.com/getkin/kin-openapi versions v0.144.0–v0.146.0 with openapi3filter.ValidationHandler.Middleware as the authentication gate and a downstream gorilla/mux router configured with UseEncodedPath().
2. Route mapping: Enumerate the target API to identify a public exact route (e.g., GET /public/status) and a protected parameterized route (e.g., GET /{id}) that share the same HTTP method and overlap after URL decoding.
3. Craft encoded request: Construct an HTTP GET request using a percent-encoded path separator that maps to the public route when decoded but matches the protected parameterized route when interpreted as raw: GET /public%2Fstatus HTTP/1.1.
4. Send unauthenticated request: Transmit the crafted request without any authentication credentials (e.g., no X-API-Key header). Ensure the request passes through a proxy that does not canonicalize/decode the URI before forwarding (e.g., Nginx with proxy_pass without a trailing slash).
5. Observe bypass: The validation layer matches /public%2Fstatus (decoded to /public/status) to the public operation and skips AuthenticationFunc. The downstream gorilla/mux router matches URL.RawPath /public%2Fstatus to /{id} with id=public%2Fstatus, returning HTTP 202 from the protected handler with zero authentication calls (GHSA Advisory).

• Network: HTTP GET requests to paths containing %2F (percent-encoded forward slash) in the path segment, particularly patterns like /public%2Fstatus or similar encoded representations of known public routes; unexpected HTTP 202 responses from endpoints that should require authentication.
• Logs: Web server or proxy access logs showing requests with %2F in the URI path returning 2xx status codes that would normally require authentication (e.g., "GET /public%2Fstatus HTTP/1.1" 202); absence of authentication log entries for requests that reached protected handlers.
• Application Logs: Protected handler execution logs showing requests with id=public%2Fstatus or similar encoded path parameter values; zero AuthenticationFunc invocations for requests that reached protected routes.
• Proxy/Reverse Proxy: Nginx access logs with entries like "GET /public%2Fstatus HTTP/1.1" 202 on listeners configured with proxy_pass without URI replacement (path-preserving configuration) (GHSA Advisory).

The primary remediation is to upgrade github.com/getkin/kin-openapi to v0.147.0, which introduces a checkEncodedPathSeparator check that rejects requests where URL.Path and URL.RawPath resolve to different operations, returning ErrEncodedPathSeparator and failing closed (Fix Commit, v0.147.0 Release). As a deployment-level workaround, configure reverse proxies (e.g., Nginx) to canonicalize URIs before forwarding — using proxy_pass with a trailing slash causes Nginx to decode percent-encoded characters, preventing the path mismatch. Additionally, avoid API designs where a public exact route and a protected parameterized route share the same HTTP method and overlap after URL decoding (GHSA Advisory).

The vulnerability was discovered and reported by Satoru Kanno of GMO CONNECT Inc. (GMO Internet Group, Inc.), who provided a detailed advisory with a self-contained reproduction test and Nginx proxy validation. The advisory was published to GitHub Security Advisories on August 18, 2026, and the fix was released the same day in v0.147.0. Red Hat tracked the issue as a deferred CVE (Bugzilla #2553587). No significant broader media coverage or notable community commentary beyond the advisory itself has been identified (GHSA Advisory, Github Advisory).