CVE-2026-118651
Medium · 5.3CVSS
5.3
EPSS
0.2%
Published
Oct 28, 2026
CISA due date
—
The record
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119331 Ladybird is a truly independent web browser. CWE-346
- CVE-2026-7005 WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request… CWE-346
- CVE-2026-119416 CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the… CWE-346
- CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-346
- CVE-2026-61546 AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to… CWE-346
- CVE-2026-118657 Echo is a Go web framework. CWE-346
- CVE-2026-115413 Missing token audience validation in the OAuth authentication mode of AWS API MCP Server… CWE-346
- CVE-2026-82332 An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint… CWE-346