CVE-2026-118265

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.

• CWE-348

• https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae
• https://github.com/labstack/echo/releases/tag/v5.4.1
• https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11826OpenPLC_v3 contains a heap-based buffer overflow in the getD…8.8
• CVE-2026-118260Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4…8.2
• CVE-2026-118261Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4…8.2
• CVE-2026-118262Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4…8.2
• CVE-2026-118263Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5'…6.3
• CVE-2026-118264Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.…9.1
• CVE-2026-118266Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo'…5.3
• CVE-2026-11827GitLab has remediated an issue in GitLab EE affecting all ve…4.9
• CVE-2026-118271A security vulnerability has been detected in a2ui-project a…4.3
• CVE-2026-118272A vulnerability was detected in a2ui-project a2ui up to 0.10…4.3
• CVE-2026-118273A flaw has been found in a2ui-project a2ui up to 0.10.6. Aff…4.3
• CVE-2026-118274A vulnerability has been found in a2ui-project a2ui up to 0.…4.3