CVE-2026-118658— Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Quick assessment

Affected

labstack echo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Echo 是一个用 Go 语言编写的 Web 框架。在 4.15.2 和 5.1.1 版本之前，方法会直接读取、或请求头中的值，而不会验证这些值是否为受支持的 Web 协议方案（scheme）。由于和中间件会利用该值来构造响应头，因此攻击者若能够控制转发协议头，即可诱导重定向使用任意 URI 协议方案。利用此漏洞需要同时满足两个条件：目标应用使用了受影响的重定向中间件，且用户与响应进行了交互。专门用于 HTTPS 的重定向变体因硬编码了 HTTPS 协议，因此不受此问题影响。该问题已在 4.15.2

CVSS 4.7 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1566 · Phishing T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Source: CVE Program / CVE List V5

Vulnerability Description

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

指向未可信站点的URL重定向(开放重定向)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
labstack	echo	>= 5.0.0, < 5.1.1	-

II. Public POCs for CVE-2026-118658

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118658

请登录查看更多情报信息。

Other References for CVE-2026-118658 (5)

https://github.com/labstack/echo/releases/tag/v5.1.1 x_refsource_MISC
https://github.com/labstack/echo/releases/tag/v4.15.2 x_refsource_MISC
https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj x_refsource_CONFIRM
https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181 x_refsource_MISC
https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118658

Same Patch Batch · labstack · 2026-10-28 · 16 CVEs total

CVE-2026-118264	9.1 CRITICAL	Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
CVE-2026-118260	8.2 HIGH	Echo: BodyDump captures request and response bodies without size limits in v4
CVE-2026-118262	8.2 HIGH	Echo: WebSocket proxy can retain connections and handlers after client disconnect
CVE-2026-118261	8.2 HIGH	Echo: Decompress permits unbounded gzip expansion in v4
CVE-2026-118650	7.5 HIGH	Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a sta
CVE-2026-118263	6.3 MEDIUM	Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
CVE-2026-118652	6.1 MEDIUM	Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP
CVE-2026-118656	6.1 MEDIUM	Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI
CVE-2026-118654	5.9 MEDIUM	Echo static file middleware route protection bypass via encoded dot-dot traversal
CVE-2026-118655	5.9 MEDIUM	Echo: Static Middleware Double-Unescape Path Traversal
CVE-2026-118657	5.9 MEDIUM	Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
CVE-2026-118651	5.3 MEDIUM	Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
CVE-2026-118266	5.3 MEDIUM	Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
CVE-2026-118265	5.3 MEDIUM	Echo: X-Real-IP extractor trusts the header value instead of the sending peer
CVE-2026-118653	5.3 MEDIUM	Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

IV. Related Vulnerabilities

Same product: echo

Same vendor: labstack

Same weakness: CWE-601