Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 4, published 23 October 2026.

Which products and versions are affected?

github.com/labstack/echo/v4 (Go) >= 4.0.0, = 5.0.0, < 5.4.1, SEMVER:introduced=5.0.0,fixed=5.4.1; Labstack Echo v4.0.0 through v4.16.0, v5.0.0 through v5.4.0, v4.0.0–v4.16.0, v5.0.0–v5.4.0.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Echo WebSocket upgrade authorization bypass

Q: Is there a fix for This vulnerability?

Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later. Until then: Reject WebSocket upgrade requests before they reach the affected Echo proxy routes, or enforce authorization independently at every upstream resource. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: critical · CVSS 4 · Published 2026-10-23

Echo is a Go web framework with a proxy middleware that forwards HTTP and WebSocket requests. When an upstream rejects a WebSocket upgrade but keeps the connection open, the proxy enters a tunnel mode that bypasses Echo's route-level authentication and authorization checks, allowing an attacker to access protected resources on the upstream without going through the framework's security controls.

Technologies: github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go), Labstack Echo. Vendors: Go, Labstack.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 4, published 23 October 2026.
Which products and versions are affected?: github.com/labstack/echo/v4 (Go) >= 4.0.0, < 4.16.1, SEMVER:introduced=4.0.0,fixed=4.16.1; github.com/labstack/echo/v5 (Go) >= 5.0.0, < 5.4.1, SEMVER:introduced=5.0.0,fixed=5.4.1; Labstack Echo v4.0.0 through v4.16.0, v5.0.0 through v5.4.0, v4.0.0–v4.16.0, v5.0.0–v5.4.0.
Is there a fix for This vulnerability?: Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later. Until then: Reject WebSocket upgrade requests before they reach the affected Echo proxy routes, or enforce authorization independently at every upstream resource. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later
```
go get github.com/labstack/echo/v4@v4.16.1
```
github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later
```
go get github.com/labstack/echo/v5@v5.4.1
```

Reject WebSocket upgrade requests before they reach the affected Echo proxy routes, or enforce authorization independently at every upstream resource.

Technical details

The Proxy middleware in Echo selected a raw tunnel mode when a client requested a WebSocket upgrade, before validating the upstream's response. If the upstream returned an HTTP 2xx response and kept the connection alive rather than sending a 101 Switching Protocols response, subsequent HTTP requests on that connection were forwarded directly to the upstream without passing through Echo's router or middleware. Exploitation requires an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without independent authorization.

Affected products

labstack Echo v4.0.0–v4.16.0, v5.0.0–v5.4.0

Timeline

2026-10-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.