CVE-2026-118264: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Severity: critical (CVSS 9.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-30
Weakness: CWE-444

Description

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.

Summary

Echo's Proxy middleware can select a raw tunnel from a client WebSocket upgrade request before confirming the upstream accepted the upgrade. If the upstream rejects it with an ordinary keep-alive response, later HTTP requests on that connection reach the upstream directly, bypassing Echo's router and route-level middleware, so authentication or authorization enforced only by Echo routes can be skipped. Affected are Echo versions 4.0.0 through 4.16.0 and 5.x before 5.4.1; exploitation requires an accessible proxy route, a cooperating rejected-upgrade response, and a target lacking independent upstream authorization. No known exploitation is reported and it is not in CISA KEV. Upgrade to 4.16.1 or 5.4.1, and until then avoid exposing proxy routes or enforce authorization at the upstream.

تختار middleware الـ Proxy في Echo نفقًا خامًا من طلب ترقية WebSocket من العميل قبل التحقق من قبول الخادم العلوي للترقية. وإذا رفض الخادم العلوي الترقية باستجابة keep-alive عادية، فإن طلبات HTTP اللاحقة على الاتصال تصل مباشرة إلى الخادم العلوي متجاوزةً موجّه Echo وmiddleware الخاصة بالمسارات، ما قد يتيح تخطي المصادقة أو التفويض المفروضين عبر مسارات Echo فقط. تتأثر إصدارات Echo من 4.0.0 حتى ما قبل 4.16.1 والإصدارات 5.x قبل 5.4.1، ويتطلب الاستغلال مسار proxy متاحًا واستجابة رفض متوافقة وهدفًا يفتقر إلى تفويض مستقل في الخادم العلوي. لا توجد تقارير عن استغلال فعلي ولم يُدرج في CISA KEV. يُنصح بالترقية إلى 4.16.1 أو 5.4.1، وإلى حين ذلك بعدم كشف مسارات proxy وفرض التفويض في الخادم العلوي.

Affected products

labstack echo: from 4.0.0, < 4.16.1; from 5.0.0, < 5.4.1

References

Get alerted when CVE-2026-118264 or the next vulnerability affects your stack