CVE-2026-118266 in Echo
Summary
by MITRE • 10/28/2026
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value that a browser-submitted request can control, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Override header getter is not settable by a cross-site form. This issue is fixed in 4.16.0 and 5.4.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The Echo web framework, widely utilized for building high-performance REST APIs and microservices in the Go programming language, contains a critical logic flaw within its MethodOverride middleware that can lead to security bypasses when combined with other authentication or validation middlewares. This vulnerability specifically affects versions prior to 4.16.0 and 5.4.0. The core issue arises from how the framework processes HTTP method overrides in conjunction with Cross-Site Request Forgery protections. In standard web application architecture, it is common practice for developers to register middleware components in a specific order within the routing chain to ensure that security checks are applied before business logic executes. However, when the MethodOverride middleware is registered prior to CSRF protection mechanisms such as token validation or Sec-Fetch-Site header verification, a dangerous race condition in logical state management occurs.
Technically, the vulnerability stems from the sequence of operations during request processing. When an HTTP POST request arrives at the Echo server, it first encounters the MethodOverride middleware if that is its position in the chain. This middleware inspects specific headers or form fields to determine if the client intends to use a different HTTP method than the one originally specified by the browser. If a safe override target is detected and applied before the CSRF middleware runs, the framework updates the internal request state to reflect this new method. Crucially, while the underlying route handler selected for execution remains tied to the original POST path, the security evaluation layer perceives the request as having been transformed into the overridden method type. Because many CSRF protections are designed specifically to validate tokens or headers against POST requests, they may fail to trigger their validation logic if the framework reports the current method as something else, such as GET or PUT, depending on configuration and implementation details of the specific CSRF middleware used.
The operational impact of this flaw is significant for applications that rely on Echo's built-in middleware ordering without explicit safeguards against override manipulation. An attacker can exploit this by crafting a cross-site request from a malicious website where an authenticated victim user’s browser automatically includes their session cookies. If the application uses a form-based method override mechanism, such as a hidden input field named according to the default X-HTTP-Method-Override convention or similar parameters that browsers allow in forms, the attacker can force the victim's browser to submit a request with a manipulated method value. Since the CSRF middleware evaluates the overridden state rather than the original HTTP verb, it may incorrectly assume the request is safe if the override target does not require strict POST-specific validation checks. This results in the complete bypass of token validation and origin verification mechanisms, allowing unauthorized state-changing actions to be performed on behalf of the authenticated user without their knowledge or consent.
This vulnerability aligns with CWE-841, Improper Enforcement of Behavioral Workflow, as it involves a failure to correctly enforce the intended sequence of security checks due to improper handling of request transformation logic. Furthermore, from an ATT&CK perspective, this flaw facilitates Cross-Site Request Forgery (CSRF) attacks by undermining the integrity of CSRF protection mechanisms, which are categorized under Tactic: Execution and Technique: User Execution in some contexts, or more accurately as a bypass for Defense Evasion techniques related to security middleware. The exploit requires an authenticated victim, meaning it is not remotely exploitable without prior access or social engineering to get a user to visit the attacker's site while logged into the target application. Additionally, successful exploitation depends on the specific configuration of the MethodOverride middleware; if the override value source is restricted to headers that browsers do not allow cross-site forms to set, such as custom HTTP headers by default, the risk is mitigated unless explicit form-based overrides are enabled and misconfigured.
To mitigate this vulnerability, organizations using Echo must upgrade immediately to version 4.16.0 or 5.4.0, where the logic has been corrected to ensure that security middleware evaluates the original request method rather than any overridden value for validation purposes. For applications unable to upgrade instantly, a temporary workaround involves reordering the middleware chain so that CSRF protection and other critical security validations are registered before the MethodOverride middleware in the post-routing sequence. This ensures that token checks and origin verifications occur against the actual HTTP verb sent by the client browser, preventing attackers from manipulating the perceived method type to bypass these controls. Developers should also audit their use of form-based method overrides, ensuring that only safe methods like GET are allowed for override targets if such functionality is necessary, thereby reducing the attack surface for potential CSRF exploitation vectors involving state-changing operations.