Read the docs
TI-2026-51613 Aliases CVE-2026-73501

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Priority HIGH 80CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 4 fixed, 14 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-287.

Summary

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Fix Partial kin-openapi (getkin): 0.144.0Red Hat: 8 advisoriesRed Hat: 4 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getkinkin-openapibefore 0.144.00.144.0Patch availableCNA
  • kin-openapi Vendorgetkin Affected before 0.144.0 Fixed in 0.144.0 Patch available CNA

Remediation

  • Fix · CNA kin-openapi (getkin) Fixed in 0.144.0

Red Hat 8 advisories

  • RHSA-2026:95517 Released 2026-11-05 · Red Hat rating Important
    Multicluster Global Hub 1.7.4 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:94612 Released 2026-11-03 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.2 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:94608 Released 2026-11-03 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.2 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
Show 5 more Red Hat advisories
  • RHSA-2026:82315 Released 2026-10-13 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-hub-rhel9
  • RHSA-2026:60866 Released 2026-08-29 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.9-0.4.hum1@aarch64, grafana12.4-12.4.9-0.4.hum1@src, grafana12.4-12.4.9-0.4.hum1@x86_64
  • RHSA-2026:59030 Released 2026-08-24 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grafana13.2-13.2.0-0.1.1.hum1@aarch64, grafana13.2-13.2.0-0.1.1.hum1@src, grafana13.2-13.2.0-0.1.1.hum1@x86_64
  • RHSA-2026:59028 Released 2026-08-24 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grafana13.1-13.1.3-0.2.hum1@aarch64, grafana13.1-13.1.3-0.2.hum1@src, grafana13.1-13.1.3-0.2.hum1@x86_64
  • RHSA-2026:54549 Released 2026-08-13 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images hugo-0.165.0-0.1.hum1@aarch64, hugo-0.165.0-0.1.hum1@src, hugo-0.165.0-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Edge Manager 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Service Interconnect 2AffectedNo fix yet
Multicluster Global Hub 1.7.4Fixed RHSA-2026:95517
Red Hat Edge Manager 1.2Fixed RHSA-2026:94608, RHSA-2026:94612
Red Hat Hardened ImagesFixed RHSA-2026:54549, RHSA-2026:59028, RHSA-2026:59030, RHSA-2026:60866
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:82315
Not affected: 13 products
  • Migration Toolkit for Applications 8
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub 1.7.4
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift GitOps
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73501
  2. 2026-10-05 Affected versions changed · Red Hat
  3. 2026-10-07 Affected versions changed · Red Hat
  4. 2026-10-07 Affected versions changed · Red Hat
  5. 2026-10-14 Fix available: RHSA-2026:82315 · Red Hat
  6. 2026-10-15 Fix available: Red Hat Migration Toolkit for Applications 8.2 · Red Hat
  7. 2026-10-23 Affected versions changed · Red Hat
  8. 2026-10-27 Affected versions changed · Red Hat
  9. 2026-10-30 Affected versions changed · Red Hat
  10. 2026-11-03 Affected versions changed · Red Hat
  11. 2026-11-04 Fix available: RHSA-2026:94612 · Red Hat
  12. 2026-11-04 Fix available: RHSA-2026:94608 · Red Hat
  13. 2026-11-04 Fix available: Red Hat Edge Manager 1.2 · Red Hat
  14. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat
  15. 2026-11-06 Fix available: RHSA-2026:95517 · Red Hat
  16. 2026-11-08 Affected versions changed · Red Hat

References

Other 3

  • TI-2026-53976 kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding CVSS 4.0HIGH 8.7
  • TI-2026-74664 Nil pointer panic in kin-openapi openapi3filter decoding CVSS 3.1HIGH 7.5
  • TI-2026-74663 YAML NaN and Inf values cause panic in kin-openapi validation CVSS 3.1HIGH 7.5
  • TI-2026-74661 kin-openapi nil pointer panic in openapi3filter on array schemas without items CVSS 3.1HIGH 7.5
  • TI-2026-74657 Uncontrolled recursion in kin-openapi crashes the process CVSS 3.1HIGH 7.5
  • TI-2026-53730 NULL pointer dereference in getkin kin-openapi CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences