## Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

- 種別: advisory
- 重大度: critical
- 関連技術: go, github
- 公開日時: 2026-10-23T20:49:37.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-cxf3-9h37-7rr8)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-cxf3-9h37-7rr8

影響: go:github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1 → 4.16.1, go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1
Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only at Echo's routes. Exploitation requires an…