IP Spoofing Vulnerability in Echo Go Framework by Labstack

CVE-2026-118651

What is CVE-2026-118651?

The Echo Go framework, versions 4.0.0 through 5.4.0, contains a vulnerability where its Proxy middleware incorrectly handles the X-Real-IP header. If the Echo.IPExtractor is not configured, an attacker can send a crafted X-Real-IP header that will be forwarded to upstream services. This behavior may allow a remote client to spoof the client’s actual IP address, compromising IP-based access controls, rate limiting, audit logging, and geographic restrictions that rely on Echo's forwarded identity. This vulnerability was addressed in Echo version 5.4.0.

References