EN PT-BR
← Voltar ao feed
critical government technology

UnrealIRCd CVE-2026-114713 label injection exploited in the wild; CISA adds it to KEV, fixed in 6.2.7.1

2 fonte(s) · 2 atualização(ões) · publicado 08/11/2026 22:59 · coletado há 16 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 14/11/2026 12:02; os links antigos trazem para cá.

Fontes: thehackernews.com ↗ securityonline.info ↗

The UnrealIRCd project reports active in-the-wild exploitation of CVE-2026-114713, a command-injection flaw in the labeled-response module that it calls the most critical in the IRC daemon in 15 years (securityonline.info). An ordinary user on a network with two or more linked servers can inject server-to-server commands that run with server authority, enabling actions such as KILL and GLINE (securityonline.info). The fix shipped on 7 November 2026 as UnrealIRCd 6.2.7.1 and a no-restart hot-patch bundle, as one of nine issues fixed in that release (securityonline.info). Exploitation attempts were reportedly seen immediately after the release (thehackernews.com). As of 14 November, CISA has added the flaw to its KEV catalog, and Federal Civilian Executive Branch agencies have a binding deadline of 16 November 2026 to remediate (thehackernews.com). The project says it found the bug in an internal audit carried out with AI assistance (securityonline.info).

Entenda a falha

A vulnerabilidade

CVE-2026-114713 (CVSS 8.6, High per the CVE record; the project calls it the most critical UnrealIRCd issue in 15 years) is an improper neutralization of delimiters flaw in the labeled-response module of UnrealIRCd. Any ordinary user on a network with two or more linked servers can inject server-to-server commands that run with server authority, enabling actions such as KILL and GLINE. No special privileges are needed beyond the linked-server setup. UnrealIRCd 6.0.0 through 6.2.7 is affected and 6.2.7.1 fixes it, as does a no-restart hot-patch bundle. UnrealIRCd 5 (EOL) is reported as similarly affected, while 3.2.x and 4 were not assessed. CISA added the flaw to KEV.

Como funciona

A client sends a message carrying the IRCv3 label message tag, and the labeled-response module echoes that label back into the replies. The label is copied as received, so a crafted one can carry line breaks and extra protocol lines. On a network with linked servers, those extra lines reach the peers, which trust commands coming from another server. The injected text, written by an ordinary user, is then handled as server-to-server commands and runs with server authority on the remote servers.

Por que é vulnerável

The root cause is missing output escaping: the labeled-response module does not escape the IRCv3 label tag when echoing it, so delimiters such as line breaks are not neutralized. Linked servers also trust whatever arrives from a peer, so the injected lines are accepted as legitimate. The articles do not explain why it went unnoticed or detail the code change, only that 6.2.7.1 and the hot-patch fix it, and that a spamfilter rule blocking invalid labels works as a mitigation on 6.0.4 or newer.

Onde está

The labeled-response module of UnrealIRCd, in its handling of the IRCv3 label message tag; the announcement names no file, function, pull request or commit.

Como foi descoberta

According to securityonline.info, the UnrealIRCd team found the bug in an internal audit carried out with AI assistance. The fix shipped on 7 November 2026 as 6.2.7.1 and a hot-patch, among nine issues fixed. The project then warned it was seeing exploitation on the internet. The Hacker News says attempts began a day after the release and that CISA added the flaw to KEV on 14 November, with a 16 November deadline for FCEB agencies. Neither article names the attackers or gives IOCs.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

No article mentions a published proof of concept, but the project says attackers are exploiting the flaw on the internet, so a working exploit exists in the hands of attackers with no public copy cited. The details and goals of the activity are unknown. Treat patching as urgent: hot-patch or upgrade to 6.2.7.1, and at minimum deploy the spamfilter workaround.

Explicação gerada por IA a partir da matéria e dos artigos, em 14/11/2026 12:18.

Detalhes técnicos

  • The labeled-response module does not escape the IRCv3 label message tag when echoing it into replies. A crafted label can carry line breaks and extra protocol lines (securityonline.info).
  • Linked servers trust commands arriving from a peer, so the injected lines run with server authority on remote servers. This allows IRCOp-level actions such as KILL and GLINE (securityonline.info). thehackernews.com describes the root cause as improper delimiter neutralization.
  • Exploitation requires a network of two or more linked servers (securityonline.info, thehackernews.com).
  • Affected versions: UnrealIRCd 6.0.0 through 6.2.7. UnrealIRCd 5 (EOL since 1 July 2023) is similarly affected. Versions 3.2.x and 4 were not assessed (securityonline.info).
  • The NVD/CNA record rates the flaw CVSS 8.6 (High) (securityonline.info).
  • The other eight fixes cover two IP address leaks (one allowing user decloaking), crashes in CHGIDENT and whowasdb, a blacklist recheck that can hang the server, a counting bug that locks out new connections, a cap on bans set by Services, and a TLS renegotiation flood (securityonline.info).
  • The project announcement names no public pull request or commit for the fix (securityonline.info).

Remediação

  1. As IRCOp, apply the project's spamfilter workaround that blocks invalid labels. It protects all linked servers running 6.0.4 or newer (securityonline.info).
  2. Run ./unrealircd hot-patch bundle-20261107 on every server, or upgrade to 6.2.7.1 and restart. The hot-patch covers 6.0.0–6.2.7 and was announced on 7 November 2026 at 15:00 UTC (securityonline.info).
  3. Verify with MODULE -all, locally and against remote servers, that labeled-response reports the patch bundle or 6.2.7.1 (securityonline.info).
  4. UnrealIRCd 5 and other EOL installs should blacklist the labeled-response module, restart, and migrate to version 6 (securityonline.info).
  5. Federal Civilian Executive Branch agencies must remediate by 16 November 2026 (thehackernews.com).

Relatos divergentes

  • Severity: securityonline.info reports CVSS 8.6 (High) in the NVD/CNA record while the project calls the flaw critical. thehackernews.com labels it high-severity yet also the most critical in 15 years. The two are not strictly contradictory: the project's label is a qualitative judgment, the score is the formal rating.
  • Privilege level: securityonline.info describes execution with server authority, while thehackernews.com says IRC operator privileges. The former is more detailed and appears to come from the project's own description.
  • Exploitation timing: securityonline.info (9 November) reports exploitation in the wild without dating it. thehackernews.com (14 November), the later source, says attempts began immediately after the 7 November fix release and adds the CISA KEV listing. Neither names the attackers or gives IOCs.

Linha do tempo

  1. thehackernews.com ↗ · pub. 14/11/2026 09:38 · coletado 14/11 10:00

    UnrealIRCd CVE-2026-114713 Server-Level Command Injection Actively Exploited on IRC Networks

    ler a análise desta fonte

    A high-severity vulnerability (CVE-2026-114713) affecting UnrealIRCd, a widely used open-source IRC server, enables attackers to execute arbitrary server-level commands with IRC operator privileges. The flaw stems from improper delimiter neutralization in the labeled-response module, permitting users on networks with multiple linked servers to inject server-to-server commands executed with server authority. Exploitation attempts were observed immediately after the fix release (6.2.7.1) on November 7, 2026, making this the most critical UnrealIRCd vulnerability in 15 years. The U.S. CISA has added the flaw to its KEV catalog, urging affected parties to patch urgently, especially Federal Civilian Executive Branch agencies with a binding directive to remediate by November 16, 2026.

  2. securityonline.info ↗ · pub. 08/11/2026 22:59 · coletado 08/11 23:00 primeiro registro

    UnrealIRCd CVE-2026-114713 exploited in the wild: label tag injection lets any user run commands with server authority

    ler a análise desta fonte

    The UnrealIRCd project reports active in-the-wild exploitation of CVE-2026-114713, a flaw it calls the most critical found in the IRC daemon in 15 years. The bug lives in the labeled-response module, which fails to escape the IRCv3 label message tag when echoing it back into replies, letting an ordinary user inject extra lines that linked servers execute as server-to-server commands with server authority — enabling KILL, GLINE and other IRCOp-level actions. The NVD/CNA record rates it CVSS 8.6 (High) while the project labels it critical; exploitation requires a network of two or more linked servers. It is one of nine issues fixed in UnrealIRCd 6.2.7.1 and in the no-restart hot-patch bundle released on 7 November 2026 (forums.unrealircd.org). The project found the flaw during an internal audit carried out with the help of AI.

    Technical Details

    The labeled-response module does not sanitise the IRCv3 label tag before echoing it into replies, so a crafted label can carry line breaks and additional protocol lines. Because commands arriving from a linked peer are trusted, the injected lines are executed with server authority on remote servers (vuldb.com). Affected: UnrealIRCd 6.0.0 through 6.2.7; UnrealIRCd 5 (EOL since 1 July 2023) is similarly affected; 3.2.x and 4 were not assessed. The other eight issues fixed are two IP address leaks (one allowing user decloaking), crashes in CHGIDENT and whowasdb, a blacklist recheck that can hang the server, a counting bug locking out new connections, a cap on bans set by Services and a TLS renegotiation flood fix.

    Fix Details

    The project released UnrealIRCd 6.2.7.1 together with the hot-patch bundle bundle-20261107, announced on the official forum on 7 November 2026 at 15:00 UTC; the hot-patch applies all nine fixes without a restart on 6.0.0–6.2.7 (forums.unrealircd.org). No public pull request or commit for the fix is named in the project announcement.

    Remediation

    1. As IRCOp, apply the project's spamfilter workaround blocking invalid labels — it protects all linked servers running 6.0.4 or newer against the critical flaw. 2. Run ./unrealircd hot-patch bundle-20261107 on every server, or upgrade to 6.2.7.1 and restart. 3. Verify with MODULE -all (locally and against remote servers) that labeled-response reports the patch bundle or 6.2.7.1 (forums.unrealircd.org). 4. UnrealIRCd 5 and other EOL installs should blacklist the labeled-response module and restart, then migrate to version 6.