CVE-2026-118657

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118657", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-28T17:25:37.561Z", "datePublished": "2026-10-28T20:14:09.883Z", "dateUpdated": "2026-11-03T13:32:02.816Z"}, "containers": {"cna": {"title": "Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p"}, {"name": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"}, {"name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"}, {"name": "https://github.com/labstack/echo/releases/tag/v4.16.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v4.16.0"}, {"name": "https://github.com/labstack/echo/releases/tag/v5.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v5.4.0"}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"version": ">= 5.0.0, < 5.4.0", "status": "affected"}, {"version": "< 4.16.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T20:14:09.883Z"}, "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0."}], "source": {"advisory": "GHSA-2ffq-g2xg-c22p", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T13:31:34.902517Z", "id": "CVE-2026-118657", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T13:32:02.816Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118657", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T13:31:34.902517Z"}}}], "references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T13:31:47.765Z"}}], "cna": {"title": "Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers", "source": {"advisory": "GHSA-2ffq-g2xg-c22p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.4.0"}, {"status": "affected", "version": "< 4.16.0"}]}], "references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p", "name": "https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1", "name": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af", "name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v4.16.0", "name": "https://github.com/labstack/echo/releases/tag/v4.16.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v5.4.0", "name": "https://github.com/labstack/echo/releases/tag/v5.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T20:14:09.883Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118657", "state": "PUBLISHED", "dateUpdated": "2026-11-03T13:32:02.816Z", "dateReserved": "2026-10-28T17:25:37.561Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T20:14:09.883Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "echo", "vendor": "labstack", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.4.0"}, {"status": "affected", "version": "< 4.16.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0."}], "id": "CVE-2026-118657", "lastModified": "2026-11-03T14:17:31.737", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118657", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T13:31:34.902517Z", "version": "2.0.3"}}]}, "published": "2026-10-28T21:16:55.693", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v4.16.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v5.4.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/labstack/echo: echo: Security control bypass via untrusted forwarded scheme headers", "id": "2563176", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563176"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-807", "details": ["Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.", "A flaw was found in Echo. The framework unconditionally trusts forwarded scheme headers from incoming requests without verifying whether they originate from a trusted proxy. A remote attacker can exploit this vulnerability by sending crafted HTTP headers to bypass HTTPS redirection controls or suppress HTTP Strict Transport Security (HSTS) headers, potentially exposing sensitive communications to interception."], "name": "CVE-2026-118657", "public_date": "2026-10-28T20:14:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118657\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118657\nhttps://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1\nhttps://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af\nhttps://github.com/labstack/echo/releases/tag/v4.16.0\nhttps://github.com/labstack/echo/releases/tag/v5.4.0\nhttps://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p"], "statement": "This vulnerability is evaluated as having Moderate impact because bypassing transport security enforcement requires specific network exposure\u2014such as direct, unprotected HTTP ingress or an edge proxy that fails to sanitize client headers\u2014and successful exploitation does not directly expose application state or grant unauthorized remote access. In standard enterprise deployments, applications built with the Echo framework are positioned behind reverse proxies or ingress controllers that overwrite client-supplied forwarding headers, significantly limiting practical attack vectors. However, if an attacker can send unsanitized forwarded scheme headers directly to an unencrypted backend, they can prevent automated HTTPS redirection or suppress HSTS headers, thereby lowering transport security protections for downstream clients.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.4.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.16.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "echo", "source": "cna", "vendor": "labstack"}, "product": "echo", "vendor": "labstack"}], "created": "2026-10-28T21:44:33.893094+00:00", "updated": "2026-11-06T02:15:18.154307+00:00", "vendors": ["labstack", "labstack$PRODUCT$echo"]}