Medium severity · published Oct 28, 2026
CVE-2026-118651
Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
New
5.3
CVSS
–
EPSS
No
On KEV
Description
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
echo · labstack
>= 4.0.0, < 5.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118651
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118651
github.com
https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
github.com
https://github.com/labstack/echo/releases/tag/v5.4.0
github.com
https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36
More from echo
9.6
CVE-2022-40083
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component
9.1
CVE-2026-118264
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
8.2
CVE-2026-118262
Echo: WebSocket proxy can retain connections and handlers after client disconnect
8.2
CVE-2026-118261
Echo: Decompress permits unbounded gzip expansion in v4
8.2
CVE-2026-118260
Echo: BodyDump captures request and response bodies without size limits in v4