CVE-2026-118657
Description
A flaw was found in Echo. The framework unconditionally trusts forwarded scheme headers from incoming requests without verifying whether they originate from a trusted proxy. A remote attacker can exploit this vulnerability by sending crafted HTTP headers to bypass HTTPS redirection controls or suppress HTTP Strict Transport Security (HSTS) headers, potentially exposing sensitive communications to interception.
Statement
This vulnerability is evaluated as having Moderate impact because bypassing transport security enforcement requires specific network exposure—such as direct, unprotected HTTP ingress or an edge proxy that fails to sanitize client headers—and successful exploitation does not directly expose application state or grant unauthorized remote access. In standard enterprise deployments, applications built with the Echo framework are positioned behind reverse proxies or ingress controllers that overwrite client-supplied forwarding headers, significantly limiting practical attack vectors. However, if an attacker can send unsanitized forwarded scheme headers directly to an unencrypted backend, they can prevent automated HTTPS redirection or suppress HSTS headers, thereby lowering transport security protections for downstream clients.
Understanding the Weakness (CWE)
Confidentiality,Access Control,Availability
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Varies by Context
When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the product to access whatever is being protected. An attacker could change these inputs using customized clients or other attacks. This change might not be detected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to exposure or modification of sensitive data, system crash, or execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
