CVE-2026-118264

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.

• CWE-444
• CWE-863

• https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec
• https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f
• https://github.com/labstack/echo/releases/tag/v4.16.1
• https://github.com/labstack/echo/releases/tag/v5.4.1
• https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118259opentelemetry-java is the Java implementation of the OpenTel…5.3
• CVE-2026-11826OpenPLC_v3 contains a heap-based buffer overflow in the getD…8.8
• CVE-2026-118260Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4…8.2
• CVE-2026-118261Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4…8.2
• CVE-2026-118262Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4…8.2
• CVE-2026-118263Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5'…6.3
• CVE-2026-118265Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5'…5.3
• CVE-2026-118266Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo'…5.3
• CVE-2026-11827GitLab has remediated an issue in GitLab EE affecting all ve…4.9
• CVE-2026-118271A security vulnerability has been detected in a2ui-project a…4.3
• CVE-2026-118272A vulnerability was detected in a2ui-project a2ui up to 0.10…4.3
• CVE-2026-118273A flaw has been found in a2ui-project a2ui up to 0.10.6. Aff…4.3