CVEslabstackCVE-2026-118657Published Oct 28, 20:14 · Updated Oct 28, 20:14 UTC
5.9
MediumCVSS 3.1 · from GitHub_M
CVE-2026-118657

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

echo · CWE-346 · CWE-346
Affectedecho
FixNo fix listed yet.
PublishedOct 28, 20:14 · GitHub_M
ScoredOct 28 · 5.9 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC

What we know

No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data. CVSS impact.

Description

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.

From GitHub_M

Affected and fixed versions

ProductAffectedFixed inecho>= 5.0.0, < 5.4.0–echo< 4.16.0–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p · github.comrefsource_CONFIRMgithub.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 · github.comrefsource_MISCgithub.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af · github.comrefsource_MISCgithub.com/labstack/echo/releases/tag/v4.16.0 · github.comrefsource_MISCgithub.com/labstack/echo/releases/tag/v5.4.0 · github.comrefsource_MISC

Other CVEs in echo

All 17 →
4.7Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto · CVE-2026-118658Oct 286.1Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI · CVE-2026-118656Oct 285.9Echo: Static Middleware Double-Unescape Path Traversal · CVE-2026-118655Oct 28