Skip to main content
cve.nowby Sazabi
← Vulnerabilities
GO-2026-6839GHSA-CXF3-9H37-7RR8

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

Exploited
No known exploitation
Fix
Fixed in github.com/labstack/echo/v4 4.16.1 · github.com/labstack/echo/v5 5.4.1
Who is exposed
Not reported

Do first: Upgrade to a fixed version: github.com/labstack/echo/v4 4.16.1 · github.com/labstack/echo/v5 5.4.1.

Published
Last modified
10/100 · provisional
None on Exploit-DB, Metasploit or GitHub

Summary

The Echo Go web framework (github.com/labstack/echo) has a flaw where rejected WebSocket upgrade requests can bypass route-level access controls. An attacker could use this to reach routes that are meant to be restricted.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

cve.now Index

10Pcve.now Index 10 of 100 · methodology v3 · provisional
  • Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
  • Exposure?/25Unknown. No advisory context yet
  • Reach10/20Affects Go packages
  • Severity?/10Unknown. No CVSS score or vendor rating
  • No patch0/5No signal

What would change the score

  • Would score about 65 if added to CISA KEV
  • Would score about 60 if CISA's SSVC rates exploitation active
  • Would score about 32 if advisories confirm default setups are exposed

How the score works · Leaderboard

What to do

  • Upgrade to a fixed version: github.com/labstack/echo/v4 4.16.1 · github.com/labstack/echo/v5 5.4.1.

Timeline

  1. Advisory published
  2. Record last updated
  3. First seen by cve.now

Affected versions

  • github.com/labstack/echo/v4Go

    From 4.0.0 · fixed in 4.16.1

  • github.com/labstack/echo/v5Go

    From 5.0.0 · fixed in 5.4.1

Evidence 5

  1. Advisory
  2. Patch
  3. Patch
  4. Repository
  5. Repository

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about GO-2026-6839

Is GO-2026-6839 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Which versions are affected by GO-2026-6839?

github.com/labstack/echo/v4 (Go): from 4.0.0 before 4.16.1. github.com/labstack/echo/v5 (Go): from 5.0.0 before 5.4.1.Source: cve.now feed data

How do I fix GO-2026-6839?

Upgrade to a fixed version: github.com/labstack/echo/v4 4.16.1 · github.com/labstack/echo/v5 5.4.1.Source: cve.now feed data

Sources

More vulnerabilities