Rejected WebSocket upgrades bypass Echo route-level access controls
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 11 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.
Summary
Echo, a Go web framework, from 4.0.0 before 4.16.1 and from 5.0.0 before 5.4.1 is affected. Its Proxy middleware takes a raw tunnel from a WebSocket upgrade before confirming the upstream accepted it (CWE-444). If the upstream rejects the upgrade with a keep-alive response, later requests reach it directly, skipping Echo's router and route middleware. A remote unauthenticated attacker can bypass Echo route access controls when the proxy target lacks its own authorization.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade to Echo 4.16.1 for 4.x or 5.4.1 for 5.x. Red Hat lists Ansible Automation Orchestrator 2026, Cost Management On Premise, Multicluster Global Hub, Multicluster Global Hub 5, Red Hat Advanced Cluster Management for Kubernetes 2 and other products as affected with no fix plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA echo (labstack) Fixed in 4.16.1, 5.4.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet |
| Cost Management On Premise | Affected | No fix yet |
| Multicluster Global Hub | Affected | No fix yet |
| Multicluster Global Hub 5 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 5 | Affected | No fix yet |
Timeline
- 2026-10-28 Threatist record created from CVE-2026-118264
- 2026-10-30 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 5
- https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8
- https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec
- https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f
- https://github.com/labstack/echo/releases/tag/v4.16.1
- https://github.com/labstack/echo/releases/tag/v5.4.1
More labstack vulnerabilities
- TI-2022-18981 Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the… CVSS 3.1CRITICAL 9.6
- TI-2026-82185 Path decoding mismatch in Echo middleware.Static exposes static files CVSS 3.1HIGH 7.5
- TI-2026-40198 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVSS 3.1HIGH 7.5
- TI-2026-82194 Rate limiter bypass in Echo via spoofed X-Forwarded-For header CVSS 3.1MEDIUM 5.3
- TI-2026-20833 Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVSS 3.1MEDIUM 5.3
- TI-2020-18793 Directory traversal on Windows in github.com/labstack/echo/v4 CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-118264 · CVE Program
- CVE-2026-118264 · NVD
- FIRST EPSS
- CVE-2026-118264 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences