CVE-2026-118264

{
  "etk_id": "ETK-2026-2898",
  "cve_id": "CVE-2026-118264",
  "display_id": "CVE-2026-118264",
  "ghsa_id": "GHSA-cxf3-9h37-7rr8",
  "euvd_id": "EUVD-2026-112396",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Echo Proxy WebSocket upgrade handling",
  "summary": "Echo Proxy middleware before v4.16.1 and v5.4.1 can allow requests to bypass route-level authentication or authorization after an unsuccessful WebSocket upgrade attempt. Exploitation requires an accessible proxy route, an upstream that keeps the connection open after rejecting the upgrade, and a target resource without independent upstream access controls.",
  "mitigation": "Upgrade Echo v4 to 4.16.1 or later, or Echo v5 to 5.4.1 or later. Until upgraded, block WebSocket upgrade requests on affected proxy routes and require authorization at upstream resources.",
  "vendor": "labstack",
  "product": "echo",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, < 4.16.1"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "4.16.1"
      ],
      "package_name": "github.com/labstack/echo/v4",
      "purl": "pkg:golang/github.com/labstack/echo/v4"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, < 5.4.1"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "5.4.1"
      ],
      "package_name": "github.com/labstack/echo/v5",
      "purl": "pkg:golang/github.com/labstack/echo/v5"
    }
  ],
  "cwes": [
    444
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 20.557060716666665,
  "t0_at": "2026-10-28T19:03:01.533000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-28T19:57:52.840848+00:00",
      "days": 0.03809384083333334,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T19:03:01.533000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-28T19:03:01.533000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T19:03:01.533000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-118264"
    }
  }
}