CVE-2026-118658

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118658", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-28T17:25:37.561Z", "datePublished": "2026-10-28T20:17:11.083Z", "dateUpdated": "2026-11-02T20:44:22.513Z"}, "containers": {"cna": {"title": "Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"}, {"name": "https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181"}, {"name": "https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df"}, {"name": "https://github.com/labstack/echo/releases/tag/v4.15.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v4.15.2"}, {"name": "https://github.com/labstack/echo/releases/tag/v5.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v5.1.1"}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"version": ">= 5.0.0, < 5.1.1", "status": "affected"}, {"version": "< 4.15.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T20:17:11.083Z"}, "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1."}], "source": {"advisory": "GHSA-23wf-92cp-8pcj", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T20:43:55.876009Z", "id": "CVE-2026-118658", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T20:44:22.513Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118658", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T20:43:55.876009Z"}}}], "references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T20:44:16.301Z"}}], "cna": {"title": "Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto", "source": {"advisory": "GHSA-23wf-92cp-8pcj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.1.1"}, {"status": "affected", "version": "< 4.15.2"}]}], "references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj", "name": "https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181", "name": "https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df", "name": "https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v4.15.2", "name": "https://github.com/labstack/echo/releases/tag/v4.15.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v5.1.1", "name": "https://github.com/labstack/echo/releases/tag/v5.1.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T20:17:11.083Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118658", "state": "PUBLISHED", "dateUpdated": "2026-11-02T20:44:22.513Z", "dateReserved": "2026-10-28T17:25:37.561Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T20:17:11.083Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "echo", "vendor": "labstack", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.1.1"}, {"status": "affected", "version": "< 4.15.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1."}], "id": "CVE-2026-118658", "lastModified": "2026-11-02T21:17:27.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118658", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T20:43:55.876009Z", "version": "2.0.3"}}]}, "published": "2026-10-28T21:16:55.827", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v4.15.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v5.1.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/labstack/echo: Echo: Arbitrary URI redirect via unvalidated forwarded scheme headers", "id": "2563178", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563178"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-601", "details": ["Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.", "A flaw was found in the Echo web framework. When handling incoming requests, the framework fails to validate forwarded protocol headers before using them to construct redirect responses. A remote attacker capable of controlling these headers could trigger redirects using an arbitrary Uniform Resource Identifier (URI) scheme, potentially facilitating phishing or unexpected client-side behavior when a user interacts with the response."], "name": "CVE-2026-118658", "public_date": "2026-10-28T20:17:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118658\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118658\nhttps://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181\nhttps://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df\nhttps://github.com/labstack/echo/releases/tag/v4.15.2\nhttps://github.com/labstack/echo/releases/tag/v5.1.1\nhttps://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"], "statement": "Red Hat rates the impact of this vulnerability as Moderate because exploitation requires the application to actively implement non-default redirect middleware and depends on user interaction to trigger client-side redirection. In typical deployment topologies where applications reside behind trusted ingress controllers or reverse proxies that overwrite forwarded headers, exposure to untrusted header injection is substantially minimized. Furthermore, redirect middleware variants enforcing HTTPS explicitly hardcode the protocol and remain unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.15.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "echo", "source": "cna", "vendor": "labstack"}, "product": "echo", "vendor": "labstack"}], "created": "2026-10-28T22:00:18.015045+00:00", "updated": "2026-10-28T22:45:15.017182+00:00", "vendors": ["labstack", "labstack$PRODUCT$echo"]}