# CVE-2026-118266: Echo MethodOverride middleware CSRF bypass

Source: https://junglewise.ai/threats/cve-2026-118266-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118266 · Severity: medium · CVSS 5.3 · Published 2026-10-28

Echo is a Go web framework used to build REST APIs and web services. The MethodOverride middleware can be abused to bypass CSRF token validation when positioned in the wrong order within the middleware chain, allowing an attacker to trick an authenticated user into performing unwanted state-changing actions like data modification or account changes.

Technologies: [github.com/labstack/echo/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-labstack-echo-v4), [github.com/labstack/echo/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5), [Labstack Echo](https://junglewise.ai/threats/technologies/labstack-echo). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Labstack](https://junglewise.ai/threats/vendors/labstack).

## Quick answers

**Is CVE-2026-118266 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118266 being exploited in the wild.

**How severe is CVE-2026-118266?** Medium severity, with a CVSS score of 5.3, published 28 October 2026.

**Which products and versions are affected?** github.com/labstack/echo/v4 (Go) < 4.16.0, SEMVER:introduced=0,fixed=4.16.0; github.com/labstack/echo/v5 (Go) >= 5.0.0, < 5.4.0, SEMVER:introduced=5.0.0,fixed=5.4.0; Labstack Echo before 4.16.0 and 5.4.0.

**Is there a fix for CVE-2026-118266?** Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.0 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.0 or later. Until then: Register the MethodOverride middleware with Echo#Pre (pre-routing) instead of the default post-routing position, or ensure CSRF middleware runs before MethodOverride in the middleware chain. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118266 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118266?** Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/labstack/echo/v4 (Go): upgrade to 4.16.0 or later

  ```sh
  go get github.com/labstack/echo/v4@v4.16.0
  ```

- github.com/labstack/echo/v5 (Go): upgrade to 5.4.0 or later

  ```sh
  go get github.com/labstack/echo/v5@v5.4.0
  ```


Register the MethodOverride middleware with Echo#Pre (pre-routing) instead of the default post-routing position, or ensure CSRF middleware runs before MethodOverride in the middleware chain.

## Technical details

Echo's MethodOverride middleware accepts POST requests overridden to safe HTTP methods (GET, HEAD, OPTIONS, TRACE, CONNECT). When MethodOverride runs before CSRF in the middleware chain, the method is changed before CSRF validation, causing both token validation and Sec-Fetch-Site checks to be skipped. An attacker can exploit this via a cross-site form submission with a controllable override value; the default X-HTTP-Method-Override header is not exploitable cross-site. This requires an authenticated victim and configuration of MethodOverride before CSRF middleware.

## Affected products

- labstack Echo before 4.16.0 and 5.4.0

## Identifiers

- CVE-2026-118266
- GHSA-r7w9-592q-9vg4
- GO-2026-6877

## Timeline

- 2026-10-28: disclosed

## References

- [https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1](https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1)
- [https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af](https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af)

## Related threats

- [Echo web framework arbitrary URI scheme redirect](https://junglewise.ai/threats/cve-2026-118658-echo-is-a-go-web-framework-prior-to-4-15-2-and-5-1-1-context)
- [Echo Go web framework scheme header spoofing and HSTS bypass](https://junglewise.ai/threats/cve-2026-118657-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context)
- [Echo open redirect in sanitizeURI with trailing slash redirect](https://junglewise.ai/threats/cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri)
- [Echo path traversal via double URL encoding in Static middleware](https://junglewise.ai/threats/cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware)
- [Echo path traversal in static file handlers via dot segment normalization](https://junglewise.ai/threats/cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s)