Cross-Site Exploit in Echo Web Framework Prior to Version 4.16.0
CVE-2026-118266
What is CVE-2026-118266?
The Echo web framework, utilized for building Go applications, contains a vulnerability in its MethodOverride middleware. This issue, present in versions prior to 4.16.0 and 5.4.0, allows an authenticated attacker to bypass CSRF protection when the MethodOverride is executed before CSRF checks in the post-routing middleware. This sequence can enable the original POST handler to remain intact while manipulating the HTTP method, skipping crucial security validations including token verification. An attacker may exploit this by controlling the override value through a browser-submitted request, especially if certain conditions are met. Best practices recommend updating to versions 4.16.0 or 5.4.0, where this issue has been effectively resolved.
Affected Version(s)
echo < 4.16.0 < 4.16.0
echo >= 5.0.0, < 5.4.0 < 5.0.0, 5.4.0