Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw     tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the     upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on     the connection are sent directly to that upstream without passing through Echo's router or route-specific     middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an     accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream     authorization. This issue is fixed in 4.16.1 and 5.4.1. (CVE-2026-118264)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw
    tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the
    upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on
    the connection are sent directly to that upstream without passing through Echo's router or route-specific
    middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an
    accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream
    authorization. This issue is fixed in 4.16.1 and 5.4.1. (CVE-2026-118264)

ID	Name	Product	Family	Type	Severity
373455	Linux Distros Unpatched Vulnerability : CVE-2026-118264	Nessus	Misc.	Local	critical
477257	SCA: security update for github.com/labstack/echo/v4, github.com/labstack/echo/v5 (GHSA-cxf3-9h37-7rr8)	Tenable Cloud Security	SCA Checks	Local	critical
477257	SCA: security update for github.com/labstack/echo/v4, github.com/labstack/echo/v5 (GHSA-cxf3-9h37-7rr8)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-118264

critical

Tenable Plugins

critical

critical

critical