{"id":"CVE-2026-73501","title":"kin-openapi is a Go project for handling OpenAPI files","summary":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without …","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-287","CWE-306"],"vendor":"Red Hat","product":"Red Hat Edge Manager 1","affected":["migration_toolkit_for_applications 8","openshift_serverless","ceph_storage 5","ceph_storage 6","ceph_storage 7","ceph_storage 8","ceph_storage 9","openshift_container_platform 4","openstack_platform 18.0","service_interconnect 2","multicluster_global_hub","advanced_cluster_management_for_kubernetes 2","edge_manager 1","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","hardened_images"],"patched":["hardened_images"],"published":"2026-08-12","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73501","references":[{"url":"https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da","label":"security-advisories@github.com"},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.144.0","label":"security-advisories@github.com"},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw","label":"security-advisories@github.com"},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73501.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-73501"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515006"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73501"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73501"},{"url":"https://access.redhat.com/errata/RHSA-2026:60866"},{"url":"https://access.redhat.com/errata/RHSA-2026:59028"},{"url":"https://access.redhat.com/errata/RHSA-2026:59030"},{"url":"https://access.redhat.com/errata/RHSA-2026:54549"},{"url":"https://github.com/getkin/kin-openapi"}],"tags":["nvd","csaf","vex","red-hat","osv","go"],"epss":0.00426,"epssPercentile":0.36392,"aliases":["GHSA-r277-6w6q-xmqw"],"ecosystem":"go","ingestedAt":"2026-08-13T19:18:21.287Z","slug":"CVE-2026-73501","body":"## Overview\n\nkin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-73501)\n\nAffected packages:\n\n- `github.com/getkin/kin-openapi < 0.144.0`\n\nPatched in:\n\n- `github.com/getkin/kin-openapi 0.144.0`\n\nSource: https://osv.dev/vulnerability/GHSA-r277-6w6q-xmqw\n\n## Vendor advisories\n\n- **RHSA-2026:60866** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60866)\n- **RHSA-2026:59028** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59028)\n- **RHSA-2026:59030** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59030)\n- **RHSA-2026:54549** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54549)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, OpenShift Serverless, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, … · no fix planned: Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73501.json)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}