Read the docs
TI-2026-82186 Aliases CVE-2026-118651GHSA-99jh-6h7p-pp36

Echo reverse proxy forwards spoofed X-Real-IP header upstream

Priority LOW 29CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.

Summary

Echo, a Go web framework, is affected from 4.0.0 before 5.4.0. When Echo.IPExtractor is not configured, the Proxy middleware keeps an attacker-supplied X-Real-IP header and forwards it to upstream services (CWE-346). A remote client without authentication can make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00207 10th percentileScored 2026-11-07
Fix Fixed echo (labstack): 5.4.0github.com/labstack/echo/v5 (Go): 5.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
labstackecho4.0.0 to before 5.4.05.4.0Patch availableCNA
—github.com/labstack/echo/v5 (Go)before 5.4.05.4.0Patch availableGHSA-99jh-6h7p-pp36
—github.com/labstack/echo/v4 (Go)4.0.0 – 4.16.2—No fix listedGHSA-99jh-6h7p-pp36
  • echo Vendorlabstack Affected 4.0.0 to before 5.4.0 Fixed in 5.4.0 Patch available CNA
  • github.com/labstack/echo/v5 (Go) Vendor— Affected before 5.4.0 Fixed in 5.4.0 Patch available GHSA-99jh-6h7p-pp36
  • github.com/labstack/echo/v4 (Go) Vendor— Affected 4.0.0 – 4.16.2 Fixed in — No fix listed GHSA-99jh-6h7p-pp36

Remediation

Upgrade to Echo 5.4.0, the fixed version for labstack echo and github.com/labstack/echo/v5. The sources list no fixed version for github.com/labstack/echo/v4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA echo (labstack) Fixed in 5.4.0
  • Fix · GHSA-99jh-6h7p-pp36 github.com/labstack/echo/v5 (Go) Fixed in 5.4.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118651
  2. 2026-10-28 Alias added: GHSA-99jh-6h7p-pp36
  3. 2026-10-28 Fix available: Go/github.com/labstack/echo/[email protected] · GHSA-99jh-6h7p-pp36
  4. 2026-10-28 CVSS score added · GHSA-99jh-6h7p-pp36
  5. 2026-10-28 Weakness changed · GHSA-99jh-6h7p-pp36
  6. 2026-10-28 4 new references · GHSA-99jh-6h7p-pp36
  7. 2026-10-29 CISA SSVC decision points changed
  8. 2026-11-06 Affected versions changed · Red Hat
  9. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2022-18981 Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the… CVSS 3.1CRITICAL 9.6
  • TI-2026-82185 Path decoding mismatch in Echo middleware.Static exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-40198 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-82194 Rate limiter bypass in Echo via spoofed X-Forwarded-For header CVSS 3.1MEDIUM 5.3
  • TI-2026-20833 Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVSS 3.1MEDIUM 5.3
  • TI-2020-18793 Directory traversal on Windows in github.com/labstack/echo/v4 CVSS 3.1MEDIUM 5.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences