UBUNTU-CVE-2026-118651: Medium severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.0
Frequently Asked Questions
Which deployments are exposed to spoofed client addresses?
Deployments using Echo Proxy middleware are exposed when Echo.IPExtractor is not configured and an upstream service trusts the X-Real-IP value forwarded by Echo. The affected Echo versions are from 4.0.0 until 5.4.0.
What does an attacker need to exploit this issue?
A remote attacker only needs to send a request containing an attacker-controlled X-Real-IP header. No authentication or user interaction is required.
What can be affected downstream?
Upstream services that use the forwarded client address for IP-based authorization, rate limiting, audit logs, or geographic restrictions can be misled by the spoofed address. The described impact is integrity-related rather than disclosure or availability.
What is the remediation?
Update to Echo 5.4.0, which fixes the issue. For deployments that cannot update immediately, configure Echo.IPExtractor so Proxy middleware does not preserve the attacker-supplied X-Real-IP header.