Is CVE-2026-118266 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118266 being exploited in the wild.

How severe is CVE-2026-118266?

Medium severity, with a CVSS score of 5.3, published 28 October 2026.

Which products and versions are affected?

github.com/labstack/echo/v4 (Go) = 5.0.0, < 5.4.0, SEMVER:introduced=5.0.0,fixed=5.4.0; Labstack Echo before 4.16.0 and 5.4.0.

How is CVE-2026-118266 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118266?

Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118266: Echo MethodOverride middleware CSRF bypass

Q: Is there a fix for CVE-2026-118266?

Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.0 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.0 or later. Until then: Register the MethodOverride middleware with Echo#Pre (pre-routing) instead of the default post-routing position, or ensure CSRF middleware runs before MethodOverride in the middleware chain. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118266 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118266?

Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118266 · Severity: medium · CVSS 5.3 · Published 2026-10-28

Echo is a Go web framework used to build REST APIs and web services. The MethodOverride middleware can be abused to bypass CSRF token validation when positioned in the wrong order within the middleware chain, allowing an attacker to trick an authenticated user into performing unwanted state-changing actions like data modification or account changes.

Technologies: github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go), Labstack Echo. Vendors: Go, Labstack.

Quick answers

Is CVE-2026-118266 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118266 being exploited in the wild.
How severe is CVE-2026-118266?: Medium severity, with a CVSS score of 5.3, published 28 October 2026.
Which products and versions are affected?: github.com/labstack/echo/v4 (Go) < 4.16.0, SEMVER:introduced=0,fixed=4.16.0; github.com/labstack/echo/v5 (Go) >= 5.0.0, < 5.4.0, SEMVER:introduced=5.0.0,fixed=5.4.0; Labstack Echo before 4.16.0 and 5.4.0.
Is there a fix for CVE-2026-118266?: Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.0 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.0 or later. Until then: Register the MethodOverride middleware with Echo#Pre (pre-routing) instead of the default post-routing position, or ensure CSRF middleware runs before MethodOverride in the middleware chain. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118266 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118266?: Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/labstack/echo/v4 (Go): upgrade to 4.16.0 or later
```
go get github.com/labstack/echo/v4@v4.16.0
```
github.com/labstack/echo/v5 (Go): upgrade to 5.4.0 or later
```
go get github.com/labstack/echo/v5@v5.4.0
```

Register the MethodOverride middleware with Echo#Pre (pre-routing) instead of the default post-routing position, or ensure CSRF middleware runs before MethodOverride in the middleware chain.

Technical details

Echo's MethodOverride middleware accepts POST requests overridden to safe HTTP methods (GET, HEAD, OPTIONS, TRACE, CONNECT). When MethodOverride runs before CSRF in the middleware chain, the method is changed before CSRF validation, causing both token validation and Sec-Fetch-Site checks to be skipped. An attacker can exploit this via a cross-site form submission with a controllable override value; the default X-HTTP-Method-Override header is not exploitable cross-site. This requires an authenticated victim and configuration of MethodOverride before CSRF middleware.

Affected products

labstack Echo before 4.16.0 and 5.4.0

Identifiers

CVE-2026-118266
GHSA-r7w9-592q-9vg4
GO-2026-6877

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.