Critical [CVE-2026-73501] ValidationHandler.Load Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
This critical-severity Red Hat Linux advisory covers CVE-2026-73501 affecting Migration Toolkit for Applications 8, OpenShift Serverless, Red Hat OpenShift Container Platform 4.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.
Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware.
The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.
This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials.
This enables unauthorized access to protected resources that should require proper authentication, compromising the application's security. This Critical flaw in `kin-openapi` allows unauthenticated attackers to bypass API security enforcement in applications utilizing `ValidationHandler` without an explicitly configured authentication function.
- < 0.144.0
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
- 0.144.0
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation
Upgrade to a fixed release: 0.144.0. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.