CVE-2026-118264: 
Wolfi vulnerability analysis and mitigation

CVE-2026-118264 is an authentication bypass vulnerability in the Proxy middleware of the Echo Go web framework (by LabStack) that allows unauthenticated attackers to circumvent route-level access controls via a rejected WebSocket upgrade. It affects Echo v4.0.0 through v4.16.0 and v5.0.0 through v5.4.0. The vulnerability was reported by researcher @Duodum and disclosed on October 22, 2026, with patches released the same day. It carries a CVSS v4.0 base score of 9.1 (Critical) (GitHub Advisory, Feedly).

The root cause is a race condition in Echo's Proxy middleware logic (CWE-444: HTTP Request Smuggling; CWE-863: Incorrect Authorization): the middleware selected a raw TCP tunnel for WebSocket upgrade requests before confirming that the upstream accepted the upgrade with a valid HTTP 101 response. If the upstream rejected the upgrade but kept the connection alive (returning an ordinary keep-alive HTTP response), subsequent HTTP requests on that same connection were forwarded directly to the upstream, bypassing Echo's router and all route-specific middleware — including authentication and authorization handlers. The patch routes WebSocket upgrades through Go's standard HTTP reverse proxy and only enters a tunnel after receiving a confirmed HTTP 101 upgrade response from the upstream; rejected upgrades are treated as ordinary HTTP requests (GitHub Advisory, v4.16.1 Release).

Successful exploitation allows an unauthenticated attacker to access upstream resources that are protected solely by Echo route-level middleware (e.g., JWT validation, session checks, or custom auth middleware), effectively bypassing authentication and authorization controls. The vulnerability impacts confidentiality (high) and integrity (high) of the vulnerable system, as an attacker can read and potentially modify data on the upstream target without authorization. Availability is not directly impacted, and the vulnerability does not enable arbitrary-host proxying or bypass authentication mechanisms implemented independently at the upstream service itself (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). Exploitation requires specific preconditions: an accessible Echo proxy route, an upstream that rejects the WebSocket upgrade without closing the connection, and a target resource on that upstream lacking independent authorization. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify a target application using Echo's Proxy middleware (v4.0.0–v4.16.0 or v5.0.0–v5.4.0) with an accessible proxy route that forwards traffic to an upstream service.
2. Send WebSocket upgrade request: Send an HTTP request to the Echo proxy route with WebSocket upgrade headers (Connection: Upgrade, Upgrade: websocket, Sec-WebSocket-Key, etc.) targeting the proxied upstream.
3. Trigger upgrade rejection: Ensure the upstream responds with a non-101 HTTP response (e.g., 200 OK with Connection: keep-alive), rejecting the WebSocket upgrade while keeping the TCP connection open.
4. Send unauthorized HTTP requests: On the same persistent TCP connection, send subsequent HTTP requests to protected upstream resources. Because Echo's router and route-specific middleware are bypassed, these requests reach the upstream directly without authentication or authorization checks enforced by Echo routes.
5. Access protected resources: Retrieve or manipulate data from the upstream target that would otherwise require authentication, achieving the attacker's objective (GitHub Advisory).

• Network: Unexpected HTTP requests to upstream services arriving on connections that were initiated with WebSocket upgrade headers but received a non-101 response; persistent keep-alive connections to the Echo proxy that subsequently carry non-WebSocket HTTP traffic.
• Logs: Echo proxy access logs showing a WebSocket upgrade request (with Upgrade: websocket header) followed immediately by standard HTTP requests on the same connection without re-authentication; upstream access logs showing requests that lack expected authentication tokens or session cookies.
• Process/Application: Upstream services receiving requests that bypass expected middleware-enforced headers (e.g., missing Authorization or session headers that Echo middleware would normally validate or inject).

Upgrade Echo to v4.16.1 (for v4.x users) or v5.4.1 (for v5.x users), which validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy before establishing a tunnel (v4.16.1 Release, v5.4.1 Release). As a workaround, reject WebSocket upgrade requests before they reach affected Echo proxy routes (e.g., at a WAF or load balancer layer), or enforce authorization independently at every upstream resource rather than relying solely on Echo route middleware. Note that Go 1.26 or later is required when upgrading to v4.16.1 due to patched golang.org/x/ dependencies (GitHub Advisory).

The vulnerability was noted by the DailyCyberSecurity account on Infosec.exchange (Mastodon) and covered by Meterpreter.org shortly after disclosure. Radar.offseq.com published threat intelligence entries describing the bypass mechanism. Community reaction has been moderate, consistent with a framework-level security fix requiring specific preconditions for exploitation. No major vendor statements beyond the LabStack advisory and release notes have been identified.