Log in Start free

Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M

CVE-2026-118264Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Critical 9.1

In plain English

A critical-severity incorrect authorization in echo from labstack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.1Critical
Exploit odds (30 days)0.4%top 62.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-labstack-echono fix listedDEBIAN-CVE-2026-118264
Debian:13golang-github-labstack-echono fix listedDEBIAN-CVE-2026-118264
Debian:14golang-github-labstack-echono fix listedDEBIAN-CVE-2026-118264
Gogithub.com/labstack/echo/v44.16.1GHSA-cxf3-9h37-7rr8
Gogithub.com/labstack/echo/v44.16.1GO-2026-6839
Gogithub.com/labstack/echo/v55.4.1GHSA-cxf3-9h37-7rr8
Gogithub.com/labstack/echo/v55.4.1GO-2026-6839
Ubuntu:22.04:LTSgolang-github-labstack-echono fix listedUBUNTU-CVE-2026-118264
Ubuntu:24.04:LTSgolang-github-labstack-echono fix listedUBUNTU-CVE-2026-118264
Ubuntu:26.04:LTSgolang-github-labstack-echono fix listedUBUNTU-CVE-2026-118264
Ubuntu:26.10golang-github-labstack-echono fix listedUBUNTU-CVE-2026-118264
Ubuntu:22.04:LTSgolang-github-labstack-echo.v2no fix listedUBUNTU-CVE-2026-118264
Ubuntu:22.04:LTSgolang-github-labstack-echo.v3no fix listedUBUNTU-CVE-2026-118264

Affected products (as reported)

VendorProductVersions
labstack echo >= 4.0.0, < 4.16.1>= 5.0.0, < 5.4.1

Weakness: CWE-444, CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References