CVE-2026-118264: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.1 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.1
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using Echo versions from 4.0.0 through 4.16.1, or version 5.4.1, are affected when they expose a proxy route and rely solely on Echo route-level middleware for authentication or authorization. The upstream target must not enforce independent authorization.
What must an attacker be able to do to exploit the issue?
An attacker needs access to a proxy route and must initiate a WebSocket upgrade request. Exploitation also requires the configured upstream to reject that upgrade with an ordinary keep-alive response, after which subsequent HTTP requests on that connection can reach the upstream directly.
Does upstream authentication prevent the bypass?
Yes. The bypass is relevant only where authentication or authorization is enforced exclusively by Echo routes or route-specific middleware. An upstream that independently authorizes requests is not described as vulnerable to this access-control bypass.
What is the remediation?
Upgrade Echo to a fixed release: 4.16.1 or 5.4.1. If an immediate upgrade is not possible, ensure upstream services enforce their own authentication and authorization rather than relying only on Echo route-level controls.