CVE-2026-118264
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
- labstack echo
- Critical
- CVSS 9.1
- Fixed version listed
Summary
Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware.
From the GitHub Advisory Database.
Read the original description
CVE record
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| labstack echo | >= 4.0.0, < 4.16.1; >= 5.0.0, < 5.4.1 | None listed |
Affected packages
| Package | Affected | Fixed in | Advisory |
|---|---|---|---|
| github.com/labstack/echo/v4 (Go) | >= 4.0.0, < 4.16.1 | 4.16.1 | GHSA-cxf3-9h37-7rr8 |
| github.com/labstack/echo/v5 (Go) | >= 5.0.0, < 5.4.1 | 5.4.1 | GHSA-cxf3-9h37-7rr8 |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v4.0, scored by GitHub)
- Weakness
- CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'); CWE-863: Incorrect Authorization
- Vendor
- labstack, echo
Timeline
- GitHub updated advisory GHSA-cxf3-9h37-7rr8 (critical). Fixed in 4.16.1, 5.4.1.
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.
- GitHub published advisory GHSA-cxf3-9h37-7rr8 (critical). Fixed in 4.16.1, 5.4.1.