IT SBIT Services
Schneeberger
DEEN
CVE tracker

Echo Proxy middleware: Rejected WebSocket upgrades can bypass route access controls

CVE-2026-118264Critical 9.1

← All vulnerabilities

Summary

The Proxy middleware of the Go web framework Echo opens a raw tunnel to the upstream when a client sends a WebSocket upgrade request, before checking whether the upstream accepted it. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the same connection go directly to the upstream and bypass Echo's router and route-specific middleware. An attacker can therefore bypass authentication or authorization that is enforced only by Echo routes, provided the proxy route is accessible, the upstream returns such a response, and the upstream has no independent authorization.

Affected

  • Go module github.com/labstack/echo/v4: 4.0.0 up to 4.16.1 (excluding)
  • Go module github.com/labstack/echo/v5: 5.0.0 up to 5.4.1 (excluding)

Fixed in

  • Echo v4: 4.16.1 (fix commit 3fb0ba7e17645bb65611e2a08875d0a2f65c421f)
  • Echo v5: 5.4.1 (fix commit 1855061e572ae9dab727c811d8382f266bfbaaec)
  • Later releases v4.16.2 and v5.4.2 keep the fix.
  • Echo v4.16.1 requires Go 1.26 or later.

Workaround

  • Reject WebSocket upgrade requests before they reach affected Echo proxy routes.
  • Enforce authorization independently at every upstream resource.
  • Disable WebSocket support on proxy routes where it is not required (third-party suggestion).
  • Note: returning a non-101 response from the upstream does not prevent the vulnerable tunnel.

Exploitation

  • No known exploitation in the wild; not listed in CISA KEV.
  • No public proof of concept found.
  • CISA SSVC: exploitation none, automatable yes, technical impact total.
  • Vendor maintainers reproduced the issue on v4.15.0, v4.16.0, v5.0.0 and v5.4.0.

Our recommendation

  • Upgrade Go services using Echo to v4.16.1 or v5.4.1 (or later). Note that v4.16.1 requires Go 1.26 or later.
  • Check go.mod and SBOMs for indirect use of Echo, not only direct imports.
  • Identify whether any Echo Proxy routes with WebSocket support are reachable from the internet, and prioritise these.
  • Until patched, apply the workarounds above on exposed proxy routes.
  • Monitor logs for unusual long-lived connections on proxy routes.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:15.

Original description (NVD)

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed