News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.2, EE 3.0.2 and EE 2.13.12 Update Released News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy

CVE-2026-100351 CVE High · CVSS 7.4 False Positive

kin-openapi: ValidationHandler Security Requirement Bypass via Encoded Path Operation Confusion

This advisory does not affect KrakenD

KrakenD Enterprise uses kin-openapi only to load and translate OpenAPI documents in the krakend openapi commands, through the openapi3 package. It never imports openapi3filter, never uses ValidationHandler, and does not route requests with gorilla/mux, so the vulnerable code path is not reachable. KrakenD Community does not include kin-openapi.

Addressed through routine dependency maintenance in EE 3.0.2, 2.13.12.

Component

kin-openapi (openapi3filter)

Disclosed

Oct 20, 2026

CVSS Score

7.4

Description

In kin-openapi 0.144.0 to 0.146.x, openapi3filter.ValidationHandler selects the operation to validate from the decoded URL.Path, while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation from URL.RawPath. When a public exact route and a protected parameterized route overlap after decoding, a request with an encoded path separator is validated as public and dispatched to the protected handler without running the configured AuthenticationFunc. Fixed in kin-openapi 0.147.0.

References

View CVE-2026-100351 on NVD View CVE-2026-100351 on GitHub Advisory Database

Stay up to date with KrakenD releases and important updates