CVE-2026-118657
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
Also known as GHSA-2ffq-g2xg-c22p, GO-2026-6879
Published 10 d ago · modified 2 d ago · JSON
Summary
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 d ago
Exploit prediction (EPSS)
0.13% probability of exploitation in the next 30 days, higher than 3% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N |
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/labstack/echo/v5 | <5.4.0 | 5.4.0 |
| go | github.com/labstack/echo/v4 | <4.16.0 | 4.16.0 |
Affected products
- labstack echo
Classification
- Weakness
- CWE-346 Origin Validation Error
References
- github.com /labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p · x_refsource_CONFIRM, exploit
- github.com /labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 · x_refsource_MISC
- github.com /labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af · x_refsource_MISC
- github.com /labstack/echo/releases/tag/v4.16.0 · x_refsource_MISC
- github.com /labstack/echo/releases/tag/v5.4.0 · x_refsource_MISC
- github.com /labstack/echo · package
Sources
- CVE List: CVE-2026-118657
- GitHub Advisory: GHSA-2ffq-g2xg-c22p
- NVD: CVE-2026-118657
- OSV: GO-2026-6879
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.