CVE-2026-73501

Summary

ValidationHandler.Load() in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on ValidationHandler as its enforcement middleware.

Details

ValidationHandler is an HTTP middleware exported by openapi3filter that validates incoming requests and responses against a loaded OpenAPI specification. Its Load() method initialises default fields before the handler begins serving:

// openapi3filter/validation_handler.go:47-49
if h.AuthenticationFunc == nil {
    h.AuthenticationFunc = NoopAuthenticationFunc
}

NoopAuthenticationFunc is defined as:

// openapi3filter/validation_handler.go:17-18
func NoopAuthenticationFunc(context.Context, *AuthenticationInput) error { return nil }

It always returns nil, meaning every security scheme check it handles is automatically approved.

When a request arrives, ServeHTTP → before → validateRequest assembles a RequestValidationInput with the current AuthenticationFunc (now the no-op) injected into Options:

// openapi3filter/validation_handler.go:91-103
options := &Options{
    AuthenticationFunc: h.AuthenticationFunc,
}
requestValidationInput := &RequestValidationInput{
    Request:    r,
    PathParams: pathParams,
    Route:      route,
    Options:    options,
}
if err = ValidateRequest(r.Context(), requestValidationInput); err != nil {
    return err
}

Inside ValidateRequest, each security requirement calls options.AuthenticationFunc:

// openapi3filter/validate_request.go:436-438
f := options.AuthenticationFunc
if f == nil {
    return ErrAuthenticationServiceMissing   // fail-closed path — never reached via ValidationHandler
}
// ...
// openapi3filter/validate_request.go:497-503
if err := f(ctx, &AuthenticationInput{...}); err != nil {
    return err
}

Because f is the no-op (not nil), the ErrAuthenticationServiceMissing guard is never triggered and f(...) returns nil, clearing the security requirement. Control then proceeds to the protected handler (validation_handler.go:61-62).

The critical contradiction is that callers who use ValidateRequest directly with a nil AuthenticationFunc get fail-closed behavior (ErrAuthenticationServiceMissing), while callers who use the higher-level ValidationHandler with a nil AuthenticationFunc get fail-open behavior. Since omitting AuthenticationFunc is the natural default, the majority of real-world integrations are vulnerable.

Affected source file and line: openapi3filter/validation_handler.go:47–49 (commit 30e2923, tag v0.143.0).

PoC

Environment

Docker (any version supporting multi-stage builds)
Go 1.25 (inside the container via golang:1.25-alpine)
getkin/kin-openapi v0.143.0 (local source copy)

Step 1 — Build the Docker image

From the repository root (parent of vuln-001/):

docker build \
  -t vuln001-auth-bypass-poc \
  -f vuln-001/Dockerfile \
  reports/github_web_233_getkin__kin-openapi

The Dockerfile copies the local kin-openapi source into /kin-openapi/ inside the image and builds a Go binary (/poc-binary) from main.go. The go.mod inside the image uses a replace directive pointing to /kin-openapi, so no network access to the Go module proxy is required.

Step 2 — Run the container

docker run --rm --network none vuln001-auth-bypass-poc

Step 3 (alternative) — Use the Python helper

python3 vuln-001/poc.py --no-cleanup

What the PoC does

main.go…

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi

These are all security issues fixed in the grafana-12.4.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Changes in grafana:

Update to version 12.4.10:

• Security:

  • CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
  • CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
  • CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
  • CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

• Bug fixes:

  • Dashboards: Fix adhoc and groupby variable datasource on UI import
  • Dashboards: Fix version dates and user display names in the legacy version history page

Update to version 12.4.9:

• Features and enhancements:

  • Dashboard Import: Labels in v2 schema

• Bug fixes:

  • Azure Monitor: fix migration for dimension filters

Update to version 12.4.8:

• Security:

  • CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

Update to version 12.4.7:

• Security:

  • CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)

• Features and enhancements:

  • Dashboards: Get annotations and dashboard endpoint performance improvements

• Bug fixes:

  • DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

Update to version 12.4.6:

• Security:

  • CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

• Features and enhancements:

  • Alerting: Add protected fields authorization check to provisioning API
  • Alerting: Return 403 instead of 500 on contact point provenance mismatch

• Bug fixes:

  • Jaeger: Handle gzip, deflate, and brotli compressed API responses
  • Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217)

• CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868)

• CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328)

• CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)

• CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

• CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)

• CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

• CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

Root has patched GHSA-r277-6w6q-xmqw in the github.com/getkin/kin-openapi package for Root:Go. Multiple fixed versions available.

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

• Security issues:

  • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
  • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
  • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
  • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
  • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
  • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
  • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
  • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
  • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
  • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
  • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
  • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
  • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

• Bug fixes and changes:

  • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
  • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
  • Native Histograms are no longer experimental. They are fully supported for production workloads.
  • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
  • TSDB compaction speed optimized by improving the block merging algorithm.
  • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
  • Added new metrics to monitor the health of the rule evaluation engine.
  • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
  • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
  • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
  • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
  • Support exporting TSDB blocks directly to cloud storage via the admin API.
  • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
  • Significant query performance boost for high-cardinality regex matchers.
  • Introduce a new UI interface for safely deleting specific time series data directly.
  • Added dynamic relabeling actions to extract substrings using regex capture groups.
  • Fixed UI displaying incorrect time ranges after a timezone change.
  • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

• Security issues:

  • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
  • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…

This update for grafana, system-user-grafana fixes the following issues:

• Update to version 12.4.10:

  • Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)
  • Bug fixes: Dashboards: Fix adhoc and groupby variable datasource on UI import Dashboards: Fix version dates and user display names in the legacy version history page

• Update to version 12.4.9:

  • Features and enhancements: Dashboard Import: Labels in v2 schema
  • Bug fixes: Azure Monitor: fix migration for dimension filters

• Update to version 12.4.8:

  • Security: CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

• Update to version 12.4.7:

  • Security: CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)
  • Features and enhancements: Dashboards: Get annotations and dashboard endpoint performance improvements
  • Bug fixes: DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

• Update to version 12.4.6:

  • Security: CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)
  • Features and enhancements: Alerting: Add protected fields authorization check to provisioning API Alerting: Return 403 instead of 500 on contact point provenance mismatch
  • Bug fixes: Jaeger: Handle gzip, deflate, and brotli compressed API responses Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

• Drop 0005-Bump-edwards25519.patch

  CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217) CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557) CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868) CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328) CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763) CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

  • CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)
  • CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

• CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

• Build only for SUSE distributions