kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0,     openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream     gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from     URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap     after decoding, an unauthenticated remote request containing an encoded path separator can be validated as     public and then dispatched to the protected handler without invoking the configured AuthenticationFunc.
    The reachable path parameter is constrained to an encoded representation that decodes to the public     literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch.
    This issue is fixed in version 0.147.0. (CVE-2026-100351)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0,
    openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream
    gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from
    URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap
    after decoding, an unauthenticated remote request containing an encoded path separator can be validated as
    public and then dispatched to the protected handler without invoking the configured AuthenticationFunc.
    The reachable path parameter is constrained to an encoded representation that decodes to the public
    literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch.
    This issue is fixed in version 0.147.0. (CVE-2026-100351)

ID	Name	Product	Family	Type	Severity
366914	Linux Distros Unpatched Vulnerability : CVE-2026-100351	Nessus	Misc.	Local	high
474703	SCA: security update for github.com/getkin/kin-openapi (GHSA-23vg-4cjm-66q5)	Tenable Cloud Security	SCA Checks	Local	high
474703	SCA: security update for github.com/getkin/kin-openapi (GHSA-23vg-4cjm-66q5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-100351

high

Tenable Plugins

high

high

high