CVE-2026-118265: Echo: X-Real-IP extractor trusts the header value instead of the sending peer
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Echo v5 deployments from 5.0.0 through 5.4.1 are exposed only when they use ExtractIPFromRealIPHeader. A client must be able to reach Echo directly or through a proxy that preserves the X-Real-IP header; the default direct extractor and Echo v4 are unaffected.
What does an attacker need to do to exploit this?
No authentication or user interaction is required. The attacker supplies an X-Real-IP value containing a loopback or private address, causing Context.RealIP to return the spoofed address when the vulnerable extractor is in use.
What application behavior makes the impact meaningful?
Applications are at risk when they use Context.RealIP from this extractor for IP allowlists, rate limiting, audit logging, or forwarding headers. Those controls may trust an attacker-controlled address rather than the actual network peer.
What should be done if the application cannot be upgraded immediately?
Do not use ExtractIPFromRealIPHeader in affected Echo v5 deployments. Use the default direct extractor instead, and ensure proxies do not preserve client-supplied X-Real-IP values.
How can I determine whether an application is affected?
Check whether it runs Echo v5 between 5.0.0 and 5.4.1 and is configured to use ExtractIPFromRealIPHeader. Test only in an authorized environment by sending a loopback or private X-Real-IP value directly or through the proxy path and checking whether Context.RealIP returns that supplied value.