A critical flaw in the LabStack Echo web framework for Go could let an unauthenticated attacker slip past login and permission checks on proxied routes. Tracked as CVE-2026-118264 and rated 9.1 out of 10 under CVSS version 4.0, it was reported by security researcher Duodum and affects Echo versions from 4.0.0 before 4.16.1 and from 5.0.0 before 5.4.1.

What is — and is not — at risk

The problem sits in Echo's Proxy middleware. When a client asks for a WebSocket upgrade on a proxied route, the middleware immediately opens a raw network tunnel, before checking whether the upstream server actually accepted the upgrade. If that server rejects the upgrade with an ordinary HTTP response but keeps the connection alive, the tunnel stays open — and later requests sent over the same connection go straight to the upstream, skipping Echo's router and its route-specific middleware entirely.

Who should treat it as urgent

That distinction matters. An attacker cannot use this flaw to reach just any host, and any login check enforced by the upstream itself still applies. The danger is for internal endpoints relying only on Echo's route checks: those can be walked around, exposing backend services meant to sit behind authentication. No active exploitation in the wild has been confirmed and no public proof-of-concept exploit has been published, per the advisory reporting — this article claims neither.

The fix: update, or block upgrades at the edge

LabStack has fixed the issue in Echo v4.16.1 and v5.4.1, which only open a tunnel after a valid upgrade response arrives. Developers should update to one of those releases. If an upgrade cannot be done at once, reject WebSocket upgrade requests before they reach affected proxy routes, and put independent authorisation checks on every upstream resource.

Sources: Meterpreter, pwn.watch, CVEFeed.