Go Web Framework Echo Proxy Middleware Vulnerability
CVE-2026-118264
9.1CRITICAL
What is CVE-2026-118264?
The Echo Go web framework has a vulnerability in its Proxy middleware, where it allows connections to bypass authentication and authorization checks due to improper handling of WebSocket upgrade requests. If a client initiates a WebSocket upgrade that is rejected by the upstream server with a keep-alive response, subsequent HTTP requests on the same connection can be sent directly to the upstream server. This can lead to unauthorized access if the upstream server does not have its own independent authorization mechanisms in place. The issue has been resolved in versions 4.16.1 and 5.4.1.
Affected Version(s)
echo >= 4.0.0, < 4.16.1 < 4.0.0, 4.16.1
echo >= 5.0.0, < 5.4.1 < 5.0.0, 5.4.1