UBUNTU-CVE-2026-118266: CSRF
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value that a browser-submitted request can control, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Override header getter is not settable by a cross-site form. This issue is fixed in 4.16.0 and 5.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echo 4.xto a version that resolves this vulnerability.Fixed in 4.16.0 - Upgrade
Upgrade
Echo 5.xto a version that resolves this vulnerability.Fixed in 5.4.0
Frequently Asked Questions
Which deployments are practically exposed to cross-site exploitation?
Deployments are exposed when MethodOverride runs before CSRF in the post-routing middleware chain and uses an override source that a browser-submitted cross-site request can control, such as the form getter. Exploitation also requires an authenticated victim.
Is the default method-override configuration vulnerable to a cross-site form attack?
The default X-HTTP-Method-Override header getter is not settable by a cross-site form. The described cross-site exploit therefore depends on a controllable override value rather than that default header getter.
What should be changed if an upgrade cannot be applied immediately?
Ensure MethodOverride is not registered before CSRF in the post-routing middleware chain, and avoid method-override getters that can be controlled by browser-submitted cross-site requests. This prevents the override from changing the method before CSRF checks run.
Which versions contain the fix?
The issue is fixed in Echo 4.16.0 and 5.4.0. Versions prior to those releases are affected under the described middleware ordering and override-source conditions.