Labstack Echo prior 4.16.1/5.4.1 Proxy Middleware improper authorization

Summaryinfo

A vulnerability marked as critical has been reported in Labstack Echo. The affected element is an unknown function of the component Proxy Middleware. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-118264. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Labstack Echo. This issue affects an unknown code of the component Proxy Middleware. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-118264 since 10/27/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 373455 (Linux Distros Unpatched Vulnerability : CVE-2026-118264), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.16.1 or 5.4.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (373455). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Labstack

Name

• Echo

Website

• Product: https://github.com/labstack/echo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion