{"id":"CVE-2026-118264","published":"2026-10-28T19:17:31Z","modified":"2026-10-30T20:17:05Z","title":"Echo is a Go web framework","vendor":"labstack","product":"echo","tier":"core","eol":null,"description":{"text":"Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.","provenance":"source","from":"NVD"},"summary":{"text":"The Proxy middleware in the Echo Go web framework (labstack/echo) selects a raw tunnel from a client WebSocket upgrade request before confirming that the configured upstream accepted the upgrade. An attacker with access to an accessible proxy route can, when the upstream rejects the upgrade with an ordinary keep-alive response, have later HTTP requests on that connection sent directly to the upstream, bypassing Echo's router and route-specific middleware, provided the target lacks independent upstream authorization.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:25:33Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","provenance":"source","from":"NVD"},"epss":{"score":0.0043,"percentile":0.37209,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":2,"pulses":[{"name":"Known_Cve | Oct 31, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae4af06a3790b65a9afe87a","created":"2026-10-30"},{"name":"Known_Cve | Oct 30, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ae35d945cba1d70e2bf3a79","created":"2026-10-29"}],"provenance":"machine"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"},{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec","tags":[]},{"url":"https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","tags":[]},{"url":"https://github.com/labstack/echo/releases/tag/v4.16.1","tags":[]},{"url":"https://github.com/labstack/echo/releases/tag/v5.4.1","tags":[]},{"url":"https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"github.com/labstack/echo/v4","vulnerableRanges":[">=4.0.0, <4.16.1"],"patched":["4.16.1"],"from":["GHSA-cxf3-9h37-7rr8"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/labstack/echo/v5","vulnerableRanges":[">=5.0.0, <5.4.1"],"patched":["5.4.1"],"from":["GHSA-cxf3-9h37-7rr8"],"provenance":"source"}],"advisories":[{"id":"GHSA-cxf3-9h37-7rr8","url":"https://github.com/advisories/GHSA-cxf3-9h37-7rr8","severity":"CRITICAL","ecosystem":"Go","package":"github.com/labstack/echo/v4","vulnerableRanges":[">=4.0.0, <4.16.1"],"patched":["4.16.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cxf3-9h37-7rr8","url":"https://github.com/advisories/GHSA-cxf3-9h37-7rr8","severity":"CRITICAL","ecosystem":"Go","package":"github.com/labstack/echo/v5","vulnerableRanges":[">=5.0.0, <5.4.1"],"patched":["5.4.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-112396","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112396","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118264","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":14.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":7.44,"detail":"percentile 0.3721"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}