Vulnerability · CVE-2026-118266
Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
Published Oct 28, 2026 · catalog updated Oct 28, 2026 · Echo has CSRF Protection
Last checked Nov 4, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-118266. EPSS is 0.16%. Act only if a listed version of Echo has CSRF Protection is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Echo has CSRF Protection).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.16%
- Remediation
- Advisory link
- Affected products
- Go github.com/labstack/echo/v4 · Go github.com/labstack/echo/v5 · golang github.com
## Summary The middleware accepts any non-empty string as the override target method — including safe methods (GET, HEAD, OPTIONS, TRACE) — when rewriting a POST request. When is registered before in the post-routing middleware chain ( ), it rewrites the request method to a safe method before evaluates it. The CSRF middleware then skips token validation for the now-safe method, allowing state-changing POST handlers to execute without any CSRF check. Both the legacy token path and the modern protection path are bypassed simultaneously. ## Affected Component - — (lines 55–71): no whitelist on the override target method - — (lines 188–189): safe-method bypass branch reads the already-rewritten method - — (line 283): safe check also reads the rewritten method ## Description ### MethodOverride accepts safe methods as override targets ( ) restricts the **source** method (only POST requests are overrideable) but applies no whitelist to the **target**: The docstring's security claim — "For security reasons, only POST method can be overridden" — refers only to the source-method restriction. There is no guard preventing POST from being rewritten to , , , or . The test suite ( ) only tests POST→DELETE and POST→PUT; POST→GET is never tested or blocked. ### CSRF safe-method branch reads the already-rewritten method ( ) makes its validation decision based on at the time it runs: If MethodOverride has already run and set , this falls into the skip branch regardless of the original HTTP method or what handler was matched. The -based path in ( ) is identically vulnerable: With (already rewritten), and the function returns — the request is allowed even when is . **Both** CSRF protection paths are bypassed in a single step. ### Execution chain In , routing and middleware wrapping are performed in one step: 1. evaluates with → matches and binds the POST handler 2. wraps it: At request execution time: 3. **MethodOverride** runs: → reads form field = → → calls 4. **CSRF** runs: = → → **s
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Go github.com/labstack/echo/v40 → 4.16.0
- Go github.com/labstack/echo/v55.0.0 → 5.4.0
- golang github.comversion unspecified
How to fix CVE-2026-118266
Upgrade
CVE-2026-118266 lists a fix boundary at 4.16.0. Compare the installed build with that boundary before you change production.
Version check
Fixed in 4.16.0 · 1 other ranges on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-118266. EPSS is 0.16%. Act only if a listed version of Echo has CSRF Protection is installed.
Which versions are affected?
Compare what you have installed with 0 → 4.16.0, 5.0.0 → 5.4.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-352: Cross-Site Request Forgery (CSRF). EPSS 0.16%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 28, 2026 · GitLab Advisory Database
Detected
The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods (GET, HEAD, OPTIONS, TRACE) — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain (e.Use()), it rewrites the request method to a safe method before CSRF evaluates it. The CSRF middleware then skips token validation for the n
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v5 fixed in 5.4.0; github.com/labstack/echo/v4 fixed in 4.16.0
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v5 fixed in 5.4.0
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v4 fixed in 4.16.0
Oct 28, 2026 · Go Vulnerability Database
Updated
## Summary The middleware accepts any non-empty string as the override target method — including safe methods (GET, HEAD, OPTIONS, TRACE) — when rewriting a POST request. When is registered before in the post-routing middleware chain ( ), it rewrites the request method to a safe method before evaluates it. The CSRF middleware then skips token validation for the now-safe method, allowing state-chan
Sources
- CVE.orgVulnerability recordCVE-2026-118266
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-118266
30-day exploitation probability 0.16%
first.org - GitLab Advisory DatabasePackage advisoryCVE-2026-118266
The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods (GET, HEAD, OPTIONS, TRACE) — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain (e.Use()), it rewrites the request method to a safe method before CSRF evaluates it. The CSRF middleware then skips token validation for the n
advisories.gitlab.com - Go Vulnerability DatabasePackage advisoryGHSA-r7w9-592q-9vg4
Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
osv.dev
References
Freshness
Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 4, 2026
- Go Vulnerability DatabaseOct 30, 2026
- GitLab Advisory DatabaseOct 30, 2026
- CVE.orgOct 29, 2026