Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Running Echo's Proxy middleware and relying on route-level auth? A rejected WebSocket upgrade can leave a raw tunnel open, and later requests on it skip that auth (CVE-2026-118264, CVSS 4.0 9.1). Not known exploited. Fixed in 4.16.1 and 5.4.1. https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8 https://t.co/bfyjcYBnbt
Patch CVE-2026-118264 now. This 9.1 CVSS Echo Go framework vulnerability allows a WebSocket upgrade bypass of route-level access controls. #Golang #EchoFramework #WebSocket #CVE2026118264 #AppSec #Cybersecurity #Vulnerability #InfoSec https://meterpreter.org/echo-go-framework-websocket-bypass-cve-2026-118264/