CVE-2026-118658 labstack CVE debrief

Who should care

Defenders responsible for systems utilizing the affected versions of the github.com/labstack/echo package should assess exposure and potential impact. This includes developers and security teams that manage applications built with echo/v4 or echo/v5.

Why it matters

The CVE-2026-118658 vulnerability in github.com/labstack/echo allows for arbitrary scheme injection via the X-Forwarded-Proto header, affecting versions prior to 4.15.2 for echo/v4 and 5.1.1 for echo/v5. Defenders should verify exposure, assess impact, and update to secure versions to prevent potential exploitation.

• Potential for scheme injection could allow attackers to manipulate the scheme used in redirects, potentially leading to security issues such as phishing or unauthorized access.
• Verification of affected versions and updating to secure versions is crucial to prevent potential exploitation.
• Monitoring for unusual activity related to redirects and schemes can help detect potential attacks.

Technical summary

The github.com/labstack/echo package, specifically versions prior to 4.15.2 for echo/v4 and prior to 5.1.1 for echo/v5, is vulnerable to arbitrary scheme injection. This occurs through the improper handling of the X-Forwarded-Proto header in the WWWRedirect and NonWWWRedirect middlewares. Defenders should prioritize verifying exposure in their systems that utilize the affected versions of the github.com/labstack/echo package and assess the potential impact of scheme injection on their applications. The CVE Program record and NVD vulnerability detail indicate an arbitrary scheme injection vulnerability exists in the WWWRedirect and NonWWWRedirect middlewares of the github.com/labstack/echo package. This issue is

Defensive priority

Defenders should prioritize verifying exposure in their systems that utilize the affected versions of the github.com/labstack/echo package and assess the potential impact of scheme injection on their applications.

Recommended defensive actions

• Verify the version of the github.com/labstack/echo package in use and update to 4.15.2 or later for echo/v4 and 5.1.1 or later for echo/v5.
• Assess the configuration of WWWRedirect and NonWWWRedirect middlewares in applications.
• Monitor for unusual scheme changes in application requests.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from the source corpus indicates that the vulnerability allows for arbitrary scheme injection via the X-Forwarded-Proto header in the WWWRedirect and NonWWWRedirect middlewares. However, specific details about exploitation or impact are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.