Bug 2563120 (CVE-2026-118264)

Summary: CVE-2026-118264 github.com/labstack/echo: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, aoconnor, asyoung, blitton, bniver, cmyers, dfreiber, dkeler, dnakabaa, drow, flucifre, gbenhaim, gmeno, gparvin, groman, jbalunas, jburrell, jhollowa, jsherril, kaycoth, kgaikwad, lchilton, lcouzens, mbarnett, mbenjamin, mhackett, mkleinhe, niyer, prichard, rhaigner, rhel-process-autobot, sfeifer, sostapov, sthirugn, suppawar, thason, tsze, twaugh, vereddy, vkumar, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Echo's Proxy middleware. When a client requests a WebSocket upgrade, the middleware establishes a direct network tunnel before verifying whether the upstream server accepted the upgrade. If the upstream server rejects the upgrade while keeping the connection alive, subsequent HTTP requests sent over that connection bypass Echo's routing and route-specific middleware. A remote attacker can exploit this flaw to gain unauthorized access to protected upstream resources that rely solely on Echo for access control.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2567384, 2567385, 2567386, 2567387, 2567388, 2567389    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-28 19:23:42 UTC 
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.