LabStack Echo CVE-2026-118657

The application must use Echo's HTTPSRedirect (or HTTPSWWWRedirect/HTTPSNonWWWRedirect/WWWRedirect/NonWWWRedirect) or the Secure/HSTS middleware, all of which consume Context.Scheme(). Scenario A (vulnerable by default): Echo listens on plaintext HTTP and is directly reachable with no L7 proxy, or the attacker can bypass the proxy and reach the backend directly, giving full control of the X-Forwarded-Proto / X-Forwarded-Protocol / X-Forwarded-Ssl / X-Url-Scheme headers - sending 'X-Forwarded-Proto: https' over HTTP defeats HTTPSRedirect. Scenario B (HSTS suppression): the app sits behind a TLS-terminating proxy that passes an attacker-controlled X-Forwarded-Proto through (e.g. nginx without 'proxy_set_header X-Forwarded-Proto $scheme;'); spoofing 'X-Forwarded-Proto: http' suppresses the Strict-Transport-Security header even though the client receives the response over HTTPS. LIMITING FACTORS: risk is materially reduced when a trusted proxy unconditionally overwrites these headers and direct backend access is prevented; converting the downgrade into data theft generally requires a man-in-the-middle position and victim traffic over the downgraded channel; before the fix there was no trusted-source configuration, so the pre-4.16.0/5.4.0 default is unsafe.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS base score of 5.9 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) reflects an unauthenticated, network-reachable flaw whose real-world impact is gated by two meaningful dampeners: high attack complexity (the attacker typically also needs a man-in-the-middle position to monetize the HTTPS downgrade) and required user interaction (a victim must actually transmit traffic over the downgraded plaintext channel). The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with patching on a normal cycle rather than an out-of-band push. No EPSS probability and no KEV status were supplied in the input, so widespread or automated exploitation cannot be confirmed or ruled out from the data - EPSS is simply missing, not low. A detailed, vendor-published proof-of-concept (curl one-liners and Go tests, stated as tested on Echo v5.0.4) exists inside the GHSA advisory, so exploitation is trivially reproducible even though no active exploitation is reported. The most important risk nuance is that the product is vulnerable by default in Scenario A (Echo listening on HTTP and directly reachable): simply using middleware.HTTPSRedirect() as documented is enough to be exposed, with no misconfiguration required. Risk drops substantially in Scenario B when a correctly configured L7 proxy overwrites X-Forwarded-Proto and direct backend access is blocked, but that relies on perimeter controls external to the framework. Net: prioritize for operators who terminate TLS at a proxy or expose Echo directly, but the complexity and UI requirements keep it below critical.

An Echo application listens on plaintext HTTP, reachable directly by clients, and relies on middleware.HTTPSRedirect() to force HTTPS. A remote unauthenticated attacker (or a victim's own traffic shaped by a network-positioned attacker) sends 'X-Forwarded-Proto: https' over HTTP, so Context.Scheme() reports the request as already secure and the redirect is suppressed, keeping the session on plaintext and enabling man-in-the-middle interception. A working proof-of-concept (curl commands and Go tests, tested on v5.0.4) is published in the GHSA advisory.