# Echo X-Real-IP header spoofing vulnerability

Source: https://junglewise.ai/threats/echo-x-real-ip-extractor-trusts-the-header-value-instead-of-the-sending-e51c0fbe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.3 · Published 2026-10-23

Echo is a Go web framework used to build web applications and APIs. The X-Real-IP header extractor in Echo v5 trusts the client-supplied header value instead of verifying the actual network source, allowing attackers to spoof their IP address. Applications relying on this for access control, rate limiting, or audit logging could be bypassed or accept forged identities.

Technologies: [github.com/labstack/echo/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5), [Labstack Echo](https://junglewise.ai/threats/technologies/labstack-echo). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Labstack](https://junglewise.ai/threats/vendors/labstack).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.3, published 23 October 2026.

**Which products and versions are affected?** github.com/labstack/echo/v5 (Go) >= 5.0.0, < 5.4.1, SEMVER:introduced=5.0.0,fixed=5.4.1; Labstack Echo v5.0.0 through v5.4.0.

**Is there a fix for This vulnerability?** Yes. github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later. Until then: Use ExtractIPDirect instead of ExtractIPFromRealIPHeader until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers with verified values. Configure trusted proxy ranges narrowly for your deployment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later

  ```sh
  go get github.com/labstack/echo/v5@v5.4.1
  ```


Use ExtractIPDirect instead of ExtractIPFromRealIPHeader until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers with verified values. Configure trusted proxy ranges narrowly for your deployment.

## Technical details

The ExtractIPFromRealIPHeader function in Echo v5 validates whether an X-Real-IP value falls within a trusted range, but fails to verify that the header comes from a trusted peer—allowing any client to inject a spoofed address. An attacker can supply loopback (127.0.0.1) or private IP ranges to bypass IP-based controls. The vulnerability requires direct network access to Echo or an intervening proxy that passes through untrusted headers.

## Affected products

- labstack Echo v5.0.0 through v5.4.0

## Timeline

- 2026-10-23: disclosed
- 2026-10-23: patched

## Related threats

- [Echo web framework arbitrary URI scheme redirect](https://junglewise.ai/threats/cve-2026-118658-echo-is-a-go-web-framework-prior-to-4-15-2-and-5-1-1-context)
- [Echo Go web framework scheme header spoofing and HSTS bypass](https://junglewise.ai/threats/cve-2026-118657-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context)
- [Echo open redirect in sanitizeURI with trailing slash redirect](https://junglewise.ai/threats/cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri)
- [Echo path traversal via double URL encoding in Static middleware](https://junglewise.ai/threats/cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware)
- [Echo path traversal in static file handlers via dot segment normalization](https://junglewise.ai/threats/cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s)