CVE-2026-53508: oasdiff Information Disclosure Vulnerability

CVE-2026-53508 Overview

oasdiff is a command-line tool and Go package that compares OpenAPI specifications and detects breaking changes between them. The vulnerability affects oasdiff versions 1.13.2 through 1.18.0. When loading an OpenAPI specification from a git revision using the rev:path form (for example, main:openapi.yaml), oasdiff failed to enforce the --allow-external-refs=false flag. The underlying library setting openapi3.Loader.IsExternalRefsAllowed = false was not applied on the git load path. External $ref pointers were resolved even when explicitly disabled, silently bypassing the intended mitigation. The maintainers patched the issue in version 1.18.1.

Critical Impact
Attackers who control referenced content in an OpenAPI spec loaded from a git revision can cause oasdiff to resolve untrusted external references, potentially exposing internal resources or triggering unintended file access [CWE-73].

Affected Products

oasdiff versions 1.13.2 through 1.18.0 (CLI and Go package)
Any CI/CD pipeline invoking oasdiff with the rev:path load form
Downstream tooling embedding the vulnerable openapi3.Loader configuration

Discovery Timeline

2026-08-31 - CVE-2026-53508 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-53508

Vulnerability Analysis

The flaw is a control of file name or path issue [CWE-73] in oasdiff's spec loader. The tool exposes an --allow-external-refs flag that governs whether external $ref pointers within an OpenAPI document are resolved during parsing. When users pass a spec path directly, the loader honors this setting. When users pass a git revision in the rev:path form, the code path that fetches and parses the spec did not propagate IsExternalRefsAllowed = false to the underlying openapi3.Loader. External references were resolved regardless of user intent.

This creates an inconsistency between the documented security control and its runtime behavior. Operators who explicitly opted out of external reference resolution received no protection when comparing specs stored in git.

Root Cause

The git-revision load path constructed a distinct loader instance without inheriting the IsExternalRefsAllowed field from the CLI configuration. The mitigation flag was silently dropped between the CLI layer and the library layer. Review the oasdiff security advisory GHSA-2jcc-mxv7-p3f9 for the maintainer analysis.

Attack Vector

An attacker who can influence OpenAPI content in a git repository processed by oasdiff can embed external $ref values pointing to attacker-controlled URLs or unintended local paths. When a victim runs oasdiff against that revision, the loader dereferences those pointers even with --allow-external-refs=false set. The result may include outbound requests, disclosure of file contents reachable by the oasdiff process, or ingestion of attacker-supplied schema fragments into downstream comparison logic.

Refer to Pull Request #974 and Pull Request #975 for the code changes that enforce the flag on the git load path.

Detection Methods for CVE-2026-53508

Indicators of Compromise

Unexpected outbound HTTP or HTTPS requests originating from CI/CD runners executing oasdiff jobs.
OpenAPI specs in tracked repositories containing $ref values pointing to external URLs or unusual filesystem paths.
Build logs showing oasdiff resolving remote schema fragments despite --allow-external-refs=false being passed.

Detection Strategies

Inventory all oasdiff invocations across CI/CD pipelines and record the version in use; flag anything from 1.13.2 through 1.18.0.
Scan OpenAPI specifications in source control for external $ref targets that resolve outside the repository root.
Correlate egress network telemetry from build agents with oasdiff execution windows to identify unauthorized reference resolution.

Monitoring Recommendations

Enable egress filtering on build runners and alert on connections initiated by oasdiff processes to non-approved destinations.
Log oasdiff command-line arguments and exit status to a central log store for retrospective analysis.
Track the oasdiff binary version deployed to developer workstations and CI images and alert on downgrades.

How to Mitigate CVE-2026-53508

Immediate Actions Required

Upgrade oasdiff to version 1.18.1 or later across all developer workstations, container images, and CI/CD pipelines.
Audit OpenAPI specs in repositories analyzed by oasdiff and remove or vet any external $ref pointers.
Restrict network egress from build runners that execute oasdiff so external references cannot reach attacker-controlled hosts.

Patch Information

The maintainers fixed the issue in oasdiff 1.18.1. The fix propagates the IsExternalRefsAllowed setting to the loader instance used on the git-revision code path. See Pull Request #832, Pull Request #974, and Pull Request #975 for the implementation details.

Workarounds

Avoid the rev:path load form until the upgrade is complete; check out the target revision to a working tree and pass the file path directly.
Run oasdiff inside a sandbox or container with no outbound network access to neutralize remote reference resolution.
Pre-scan OpenAPI documents for external $ref entries and reject any that reference hosts or paths outside the trusted repository scope.

bash

# Upgrade oasdiff to the patched release
go install github.com/oasdiff/oasdiff@v1.18.1

# Verify the installed version
oasdiff --version