CVE-2026-118651

Name of the Vulnerable Software and Affected Versions Echo versions 4.0.0 through 5.3.x

Description In the Proxy middleware, the framework may preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. This occurs because the ProxyConfig.ToMiddleware() function fails to overwrite the header if it is already present and no extractor is defined. A remote client can spoof their client address, which can be used to bypass IP-based access controls, rate limiting, geographic restrictions, or poison audit logs that trust the forwarded identity.

Recommendations Update to Echo version 5.4.0. As a temporary workaround, configure Echo.IPExtractor (e.g., using echo.ExtractIPDirect() or echo.ExtractIPFromXFFHeader()) to ensure the X-Real-IP header is derived from a trusted source.