---
id: CVE-2026-73501
title: kin-openapi is a Go project for handling OpenAPI files
summary: >-
  kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0,
  ValidationHandler.Load() in openapi3filter/validation_handler.go silently
  replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns
  nil without …
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-287
  - CWE-306
vendor: Red Hat
product: Red Hat Edge Manager 1
affected:
  - migration_toolkit_for_applications 8
  - openshift_serverless
  - ceph_storage 5
  - ceph_storage 6
  - ceph_storage 7
  - ceph_storage 8
  - ceph_storage 9
  - openshift_container_platform 4
  - openstack_platform 18.0
  - service_interconnect 2
  - multicluster_global_hub
  - advanced_cluster_management_for_kubernetes 2
  - edge_manager 1
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - hardened_images
patched:
  - hardened_images
published: '2026-08-12'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73501'
references:
  - url: >-
      https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da
    label: security-advisories@github.com
  - url: 'https://github.com/getkin/kin-openapi/releases/tag/v0.144.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw
    label: security-advisories@github.com
  - url: >-
      https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73501.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-73501'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2515006'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-73501'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73501'
  - url: 'https://access.redhat.com/errata/RHSA-2026:60866'
  - url: 'https://access.redhat.com/errata/RHSA-2026:59028'
  - url: 'https://access.redhat.com/errata/RHSA-2026:59030'
  - url: 'https://access.redhat.com/errata/RHSA-2026:54549'
  - url: 'https://github.com/getkin/kin-openapi'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.00426
epssPercentile: 0.36527
aliases:
  - GHSA-r277-6w6q-xmqw
ecosystem: go
ingestedAt: '2026-08-13T19:18:21.287Z'
---

## Overview

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-73501)

Affected packages:

- `github.com/getkin/kin-openapi < 0.144.0`

Patched in:

- `github.com/getkin/kin-openapi 0.144.0`

Source: https://osv.dev/vulnerability/GHSA-r277-6w6q-xmqw

## Vendor advisories

- **RHSA-2026:60866** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60866)
- **RHSA-2026:59028** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59028)
- **RHSA-2026:59030** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59030)
- **RHSA-2026:54549** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54549)
- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, OpenShift Serverless, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, … · no fix planned: Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73501.json)