---
id: CVE-2026-79659
title: >-
  Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the
  fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of
  safe request methods with URL validation
summary: >-
  Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the
  fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of
  safe request methods with URL validation. Authenticated attackers can supply
  arbit…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
vendor: lin-snow
product: github.com/lin-snow/ech0
affected:
  - github.com/lin-snow/ech0 < 1.4.8-0.20260503040602-091d26d2d942
patched:
  - github.com/lin-snow/ech0 1.4.8-0.20260503040602-091d26d2d942
published: '2026-08-25'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:14:58.577'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79659'
references:
  - url: 'https://github.com/lin-snow/Ech0/security/advisories/GHSA-8mc6-xjpr-h98x'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ech0-before-server-side-request-forgery-via-fetchpeerconnectinfo
    label: disclosure@vulncheck.com
  - url: 'https://github.com/lin-snow/Ech0/security/advisories/GHSA-8mc6-xjpr-h98x'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://github.com/lin-snow/Ech0/commit/091d26d2d942df6df9f520328d2f9cf2592bbefc
  - url: 'https://github.com/lin-snow/Ech0'
tags:
  - nvd
  - osv
  - go
epss: 0.00264
epssPercentile: 0.1617
aliases:
  - GHSA-8mc6-xjpr-h98x
  - GO-2026-5259
ecosystem: go
ingestedAt: '2026-08-27T19:27:46.445Z'
---

## Overview

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata endpoints by triggering connection health checks or peer connection operations.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-79659)

Affected packages:

- `github.com/lin-snow/ech0 < 1.4.8-0.20260503040602-091d26d2d942`

Patched in:

- `github.com/lin-snow/ech0 1.4.8-0.20260503040602-091d26d2d942`

Source: https://osv.dev/vulnerability/GHSA-8mc6-xjpr-h98x