Go Web Framework Vulnerability in Echo Affects Redirect Mechanism
CVE-2026-118658
4.7MEDIUM
What is CVE-2026-118658?
A vulnerability in the Echo Go web framework allows attackers to exploit inaccurate handling of URI schemes in Context.Scheme. The flaw occurs when Echo returns values from headers like X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without proper validation. This can lead to unintended redirects to arbitrary URIs if an attacker controls these headers. To mitigate this issue, it's essential to upgrade to version 4.15.2 or 5.1.1, which contain the necessary fixes to secure the redirect functionality against such manipulations.
Affected Version(s)
echo >= 5.0.0, < 5.1.1 < 5.0.0, 5.1.1
echo < 4.15.2 < 4.15.2