CVE-2026-118651
Description
A flaw was found in Echo. When the proxy middleware is used without an explicit IP extractor configured, it retains and forwards attacker-supplied X-Real-IP headers to upstream services. A remote attacker can exploit this vulnerability to spoof their client Internet Protocol (IP) address. This flaw allows an attacker to bypass IP-based access controls, rate limiting, and geographic restrictions, or compromise audit logs.
Statement
This vulnerability is rated as Moderate severity because, while it can be triggered remotely without authentication, successful exploitation is limited to integrity impacts such as spoofing network identities rather than direct system compromise or information leakage. The issue only manifests when applications implement Echo's reverse proxy functionality with default configurations that omit an explicit IP extractor. Furthermore, downstream consequences depend heavily on backend architecture, requiring upstream services to implicitly trust the forwarded client header for policy enforcement, rate restrictions, or audit trails.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
