Zero Radar
← feed
CriticalVulnerabilityCVE-2026-118264updated 28 Oct 2026, 19:22 UTC

Echo web framework proxy can let requests skip login checks

A web app built with Echo can accidentally forward a visitor's later requests straight to a backend server, skipping the app's own login and permission checks. Someone who can reach that proxy route could then reach backend pages they shoul

Fix availableOfficial, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesgo/github.com/labstack/echo/v4 4.16.1; go/github.com/labstack/echo/v5 5.4.1 · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends upgradeWebSocket upgrade request to proxy route
  2. 2Echo opens raw tunnelTunnel opened before upstream accepts upgrade
  3. 3Upstream rejects upgradeResponds with ordinary keep-alive HTTP response
  4. 4Later requests go directSent to upstream, skipping Echo router and middleware
  5. 5Protected resource reachedUpstream resource lacks independent authorization
  6. ResultEcho route authorization is bypassed

What happened

Echo's Proxy middleware opens a raw tunnel on any WebSocket upgrade request before confirming the upstream accepted the upgrade. If the upstream rejects it but keeps the connection alive, subsequent HTTP requests bypass Echo's router and route-specific middleware.

Why it is dangerous: Authentication or authorization enforced only by Echo routes can be bypassed, exposing upstream resources that lack their own access control.

Are you affected?

You are affected if you use Echo v4 from 4.0.0 up to 4.16.0, or Echo v5 from 5.0.0 up to 5.4.0, and expose a Proxy middleware route whose upstream does not enforce its own authorization.

Package / productAffected versionsFixed in
github.com/labstack/echo/v4 · go>= 4.0.0, < 4.16.14.16.1
github.com/labstack/echo/v5 · go>= 5.0.0, < 5.4.15.4.1

What to do

  1. Update github.com/labstack/echo/v4 to 4.16.1 or later, or github.com/labstack/echo/v5 to 5.4.1 or later
  2. Until patched, reject WebSocket upgrade requests before they reach affected Echo proxy routes
  3. Enforce authorization independently at every upstream resource behind the proxy

Timeline

  1. 23 Oct 2026, 20:49 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 19:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 19:22 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 19:22 UTC
    Fixed version published: github.com/labstack/echo/v4 4.16.1, github.com/labstack/echo/v5 5.4.1 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118264 · GHSA-cxf3-9h37-7rr8
CVSS
9.1 / 10
Disclosed
23 Oct 2026, 20:49 UTC
On Zero Radar
28 Oct 2026, 19:17 UTC (5 days after disclosure)
Last change
28 Oct 2026, 19:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Echo web framework proxy can let requests skip login checks · Zero Radar