Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-118264: Echo web framework can bypass authentication via proxy
CVE-2026-118264 · published today
Summary
Versions of the Echo Go web framework (4.0.0‑4.16.1 and 5.0.0‑5.4.1) may forward traffic to an upstream server without applying its own security checks. If the upstream rejects a WebSocket upgrade, later requests can go straight to that server, bypassing any login or permission checks defined in Echo. Update to Echo 4.16.1 or later, or 5.4.1 or later, to close the gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | labstack | echo | >= 4.0.0, < 4.16.1 |
| Debian:12 | debian | golang-github-labstack-echo | All versions |
Original advisory text
DEBIAN-CVE-2026-118264
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.
References
- https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec x_refsource_MISC
- https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f x_refsource_MISC
- https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8 x_refsource_CONFIRM
- https://github.com/labstack/echo/releases/tag/v4.16.1 x_refsource_MISC
- https://github.com/labstack/echo/releases/tag/v5.4.1 x_refsource_MISC
- https://security-tracker.debian.org/tracker/CVE-2026-118264 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-863Incorrect Authorization
Timeline
Published28 Oct 2026
Updated29 Oct 2026
First seen28 Oct 2026
Track software like this
Free during beta