CVE-2026-118658: Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.15.2 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.1.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Echo versions before 4.15.2 or 5.1.1 are exposed only if they enable the WWWRedirect or NonWWWRedirect middleware. HTTPS-specific redirect middleware variants are not affected.
What does an attacker need to exploit it?
An attacker must be able to supply a forwarded scheme header, such as X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme, to an affected redirect middleware. Exploitation also requires a user to interact with the resulting redirect response.
How can I determine whether my application is affected?
Check the Echo version and whether WWWRedirect or NonWWWRedirect middleware is configured. If either middleware is in use, test whether a request carrying one of the forwarded scheme headers can influence the URI scheme in the Location response header.
What should be done if upgrading is not immediately possible?
Prevent untrusted clients from controlling X-Forwarded-Proto, X-Forwarded-Protocol, and X-Url-Scheme before requests reach Echo. Upgrade to Echo 4.15.2 or 5.1.1 when possible.