CVE-2026-73501

Aliases:DEBIAN-CVE-2026-73501GHSA-r277-6w6q-xmqwUBUNTU-CVE-2026-73501GO-2026-6095RHSA-2026:59028
Advisory lineage Upstream: 0 Downstream: 4
Deferred
Published: 12 Aug 2026, 21:23
Last modified:13 Aug 2026, 13:06

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.1 CRITICAL
v3.1 (cve.org)
EPSS Score
0.43% LOW
0% probability +0.08%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Aug 2026, 21:23
Published
Vulnerability first disclosed
13 Aug 2026, 13:06
Last Modified
Vulnerability information updated

Description

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.43%• Percentile: 37%

Techniques & Countermeasures

  • CWE-287•Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Systems

  • debian•golang-github-getkin-kin-openapi

    all | all | all | all

  • ubuntu•golang-github-getkin-kin-openapi

    all | all | all

  • getkin•kin-openapi

    < 0.144.0

  • github.com/getkin•kin-openapi

    < 0.144.0

  • redhat•grafana13.1

    < 0:13.1.3-0.2.hum1

References (14)