# Echo Go framework: rejected WebSocket upgrades let requests bypass route-level auth in the Proxy middleware · pwn.watch

> Echo's Proxy middleware opened a raw tunnel as soon as a client asked for a WebSocket upgrade, before checking whether the upstream accepted it. If the upstream answered with an ordinary HTTP response and kept the connection alive, later HTTP requests on that connection went straight to the upstream without passing through Echo's router or route-specific middleware, which can bypass authentication or authorization enforced only at Echo's routes. It needs an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without its own authorization. It affects the v4 and v5 release lines; upgrade to v4.16.1 or v5.4.1. GitHub rates it critical; no CVE id has been assigned yet.

Page: https://pwn.watch/i/labstack-echo-proxy-websocket-auth-bypass-ghsa-cxf3-9h37-7rr8 · generated 2026-10-23T22:18:51.766Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Echo (github.com/labstack/echo) Proxy middleware
- Started: 2026-10-23
- Affected: github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1; github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1
- Fixed in: github.com/labstack/echo/v4 4.16.1; github.com/labstack/echo/v5 5.4.1

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/labstack-echo-proxy-websocket-auth-bypass-ghsa-cxf3-9h37-7rr8/feed.xml
- JSON Feed: https://pwn.watch/i/labstack-echo-proxy-websocket-auth-bypass-ghsa-cxf3-9h37-7rr8/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/labstack-echo-proxy-websocket-auth-bypass-ghsa-cxf3-9h37-7rr8.json
- This file: https://pwn.watch/i/labstack-echo-proxy-websocket-auth-bypass-ghsa-cxf3-9h37-7rr8/llms.txt

## Updates (newest first)
- 2026-10-23: Echo publishes GHSA-cxf3-9h37-7rr8 and releases v4.16.1 and v5.4.1 with the fix. (https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8)

## Fix brief
# Security brief: Echo Go framework: rejected WebSocket upgrades let requests bypass route-level auth in the Proxy middleware

Source: https://pwn.watch/i/labstack-echo-proxy-websocket-auth-bypass-ghsa-cxf3-9h37-7rr8 · status: live · severity: critical · updated Oct 23, 2026, 21:26 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Echo's Proxy middleware opened a raw tunnel as soon as a client asked for a WebSocket upgrade, before checking whether the upstream accepted it. If the upstream answered with an ordinary HTTP response and kept the connection alive, later HTTP requests on that connection went straight to the upstream without passing through Echo's router or route-specific middleware, which can bypass authentication or authorization enforced only at Echo's routes. It needs an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without its own authorization. It affects the v4 and v5 release lines; upgrade to v4.16.1 or v5.4.1. GitHub rates it critical; no CVE id has been assigned yet.

Severity detail: GitHub-rated critical; only affects apps using Echo's Proxy middleware where the upstream relies on Echo for auth

- Product: Echo (github.com/labstack/echo) Proxy middleware

## Affected versions
- github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1
- github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- github.com/labstack/echo/v4 4.16.1
- github.com/labstack/echo/v5 5.4.1

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
If a Go service imports github.com/labstack/echo/v4 below 4.16.1 or github.com/labstack/echo/v5 below 5.4.1 and uses the Proxy middleware, bump it (go get github.com/labstack/echo/v4@v4.16.1 or github.com/labstack/echo/v5@v5.4.1). Workaround: reject WebSocket upgrade requests before they reach proxy routes, or enforce authorization at every upstream resource.

## Latest updates
- Oct 23, 2026: Echo publishes GHSA-cxf3-9h37-7rr8 and releases v4.16.1 and v5.4.1 with the fix.

## Advisories
- [GHSA-cxf3-9h37-7rr8: Rejected WebSocket upgrades can bypass Echo route-level access controls](https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8) (labstack/echo)
- [GHSA-cxf3-9h37-7rr8](https://github.com/advisories/GHSA-cxf3-9h37-7rr8) (GitHub Advisory Database)
- [Echo v4.16.1 release](https://github.com/labstack/echo/releases/tag/v4.16.1) (labstack/echo)
- [Echo v5.4.1 release](https://github.com/labstack/echo/releases/tag/v5.4.1) (labstack/echo)

---
Machine-readable: https://pwn.watch/i/labstack-echo-proxy-websocket-auth-bypass-ghsa-cxf3-9h37-7rr8.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.