CVE-2026-100351

What it actually does

The flaw permits an unauthenticated remote request containing an encoded path separator to pass openapi3filter.ValidationHandler checks (which operate on decoded URL.Path) while the downstream gorilla/mux router (configured with UseEncodedPath) dispatches the request to a different protected parameterized handler (selected from URL.RawPath), bypassing the configured AuthenticationFunc when public exact routes and protected routes overlap after decoding.

Why it matters to the business

Attackers can reach protected application endpoints in affected Grafana and Hugo deployments on Red Hat without authentication, exposing sensitive operations and data; the issue affects multiple maintained Red Hat packages and has been public for 13 days with no known exploits yet.

How an attack unfolds

An attacker identifies overlapping public literal and protected parameterized routes that collide after URL decoding, then issues a request whose encoded path separator is accepted by validation as the public route yet is routed by RawPath to the protected handler, evading AuthenticationFunc entirely; proxies that canonicalize URIs block the mismatch.

How to fix it

Upgrade the affected Red Hat packages to the exact fixed versions: grafana12-4-main to 12.4.12-0.4.hum1, grafana13-1-main to 13.1.8-0.3.hum1, grafana13-2-main to 13.2.3-0.3.hum1, and hugo-main to 0.168.0-0.1.hum1 (all under RHSA-2026:82637); ensure any direct or transitive dependency on kin-openapi is at least 0.147.0.

How to confirm the fix worked

Confirm installed package versions match the listed fixed releases, then test overlapping routes with encoded-path requests to verify AuthenticationFunc is invoked on every dispatch; re-run any existing route-coverage tests that include UseEncodedPath configurations.

Typical attack path

1. Map application routes to locate public exact and protected parameterized routes sharing a method and colliding after decoding
2. Craft an HTTP request whose path uses an encoded separator that decodes to the public literal route
3. Send the request so that ValidationHandler accepts it against the public route
4. Allow the gorilla/mux router to dispatch the same request via RawPath to the protected handler
5. Execute privileged operations without invoking AuthenticationFunc

How to detect it

Review web server and application logs for requests containing percent-encoded path separators that target endpoints normally requiring authentication; correlate timestamps with successful access to protected handlers that should have triggered authentication failures.

What your security team should do

• Apply the listed Red Hat package updates immediately given the 13-day public disclosure window
• Audit all route definitions for literal-versus-parameterized overlaps that could be exploited via encoded separators
• Disable UseEncodedPath where feasible or add explicit path canonicalization before routing
• Monitor for any new exploit maturity indicators or threat-actor adoption