CVE-2026-79659 Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo
Authenticated attackers can exploit Ech0 to access internal services and cloud metadata via unvalidated URLs in peer connection operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79659?
CVE-2026-79659 is a high-severity server-side request forgery vulnerability in lin-snow Ech0, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata endpoints by triggering connection health checks or peer connection operations.
Weakness: CWE-918
Which versions are affected by CVE-2026-79659?
3 open source packages ship an affected version, including github.com/lin-snow/ech0.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lin-snow/ech0 Go | All versions | 1.4.8-0.20260503040602-091d26d2d942 |
github.com/lin-snow/ech0 Go | All versions | 1.4.8-0.20260503040602-091d26d2d942 |
github.com/lin-snow/ech0 Go | All versions | 1.4.8-0.20260503040602-091d26d2d942 |
How do I fix CVE-2026-79659?
Upgrade github.com/lin-snow/ech0 to 1.4.8-0.20260503040602-091d26d2d942 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-79659 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79659 exists.
Sources
Also known as GHSA-8mc6-xjpr-h98x, GHSA-9g26-825h-8v6p, GO-2026-5259.