{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118651", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-28T17:25:37.561Z", "datePublished": "2026-10-28T19:30:01.320Z", "dateUpdated": "2026-10-29T20:53:54.404Z"}, "containers": {"cna": {"title": "Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36"}, {"name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"}, {"name": "https://github.com/labstack/echo/releases/tag/v5.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v5.4.0"}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"version": ">= 4.0.0, < 5.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T19:31:47.851Z"}, "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0."}], "source": {"advisory": "GHSA-99jh-6h7p-pp36", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T15:43:33.931251Z", "id": "CVE-2026-118651", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T20:53:54.404Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118651", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T15:43:33.931251Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T15:43:34.926Z"}}], "cna": {"title": "Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default", "source": {"advisory": "GHSA-99jh-6h7p-pp36", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"status": "affected", "version": ">= 4.0.0, < 5.4.0"}]}], "references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36", "name": "https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af", "name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v5.4.0", "name": "https://github.com/labstack/echo/releases/tag/v5.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T19:31:47.851Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118651", "state": "PUBLISHED", "dateUpdated": "2026-10-29T20:53:54.404Z", "dateReserved": "2026-10-28T17:25:37.561Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T19:30:01.320Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "echo", "vendor": "labstack", "versions": [{"status": "affected", "version": ">= 4.0.0, < 5.4.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0."}], "id": "CVE-2026-118651", "lastModified": "2026-10-29T21:17:16.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118651", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T15:43:33.931251Z", "version": "2.0.3"}}]}, "published": "2026-10-28T20:17:22.073", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v5.4.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/labstack/echo: Echo: IP address spoofing via forwarded X-Real-IP header", "id": "2563155", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563155"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-290", "details": ["Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.", "A flaw was found in Echo. When the proxy middleware is used without an explicit IP extractor configured, it retains and forwards attacker-supplied X-Real-IP headers to upstream services. A remote attacker can exploit this vulnerability to spoof their client Internet Protocol (IP) address. This flaw allows an attacker to bypass IP-based access controls, rate limiting, and geographic restrictions, or compromise audit logs."], "name": "CVE-2026-118651", "public_date": "2026-10-28T19:30:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118651\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118651\nhttps://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af\nhttps://github.com/labstack/echo/releases/tag/v5.4.0\nhttps://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36"], "statement": "This vulnerability is rated as Moderate severity because, while it can be triggered remotely without authentication, successful exploitation is limited to integrity impacts such as spoofing network identities rather than direct system compromise or information leakage. The issue only manifests when applications implement Echo's reverse proxy functionality with default configurations that omit an explicit IP extractor. Furthermore, downstream consequences depend heavily on backend architecture, requiring upstream services to implicitly trust the forwarded client header for policy enforcement, rate restrictions, or audit trails.", "threat_severity": "Moderate"}