CVE-2026-118264 - Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
CVE ID :CVE-2026-118264 Published : Oct. 28, 2026, 7:17 p.m. | 1 hour, 7 minutes ago Description :Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream...