CVE-2026-118265
Description
A flaw was found in the Echo web framework. A remote attacker can spoof their client Internet Protocol (IP) address by sending a crafted request with an arbitrary X-Real-IP header, such as an internal or loopback address. Because the framework checks whether the header value itself falls within a trusted range rather than validating the direct network connection, applications relying on this extractor accept the forged identity. This may allow an attacker to bypass IP-based access restrictions and rate limits or corrupt security audit logs.
Statement
This vulnerability is rated with Moderate severity because, although an unauthenticated remote attacker can spoof client identity, exploitation requires applications to explicitly opt in to the non-default X-Real-IP extractor without upstream proxy sanitization. Under default configurations, services rely on direct connection extraction and remain unaffected. Furthermore, the risk is confined to bypassing IP-based restrictions, evading rate limits, or spoofing audit logs, rather than enabling code execution or compromising host confidentiality.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
An attacker could utilize the untrusted data source to bypass protection mechanisms and gain access to sensitive data.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
