UBUNTU-CVE-2026-118264: Critical severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.1 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.1
Frequently Asked Questions
Which Echo versions contain the fix?
The issue is fixed in Echo 4.16.1 and 5.4.1. Affected versions are stated as 4.0.0 through versions before 4.16.1, and the affected 5.x line before 5.4.1.
Which deployments are realistically exposed?
Exposure requires an accessible Echo proxy route and authorization that is enforced only by Echo routing or route-specific middleware. The upstream target must not independently enforce the required authorization.
What conditions must an attacker satisfy to bypass Echo route protections?
The attacker needs to initiate a client WebSocket upgrade through the proxy route, and the configured upstream must reject that upgrade using an ordinary keep-alive response. Subsequent HTTP requests on that connection can then reach the upstream without passing through Echo's router or route-specific middleware.