EN PT-BR
← Voltar ao feed
critical

UnrealIRCd CVE-2026-114713 exploited in the wild: label tag injection lets any user run commands with server authority

1 fonte(s) · 1 atualização(ões) · publicado 08/11/2026 22:59 · coletado há 1 hora

The UnrealIRCd project reports active in-the-wild exploitation of CVE-2026-114713, a flaw it calls the most critical found in the IRC daemon in 15 years. The bug lives in the labeled-response module, which fails to escape the IRCv3 label message tag when echoing it back into replies, letting an ordinary user inject extra lines that linked servers execute as server-to-server commands with server authority — enabling KILL, GLINE and other IRCOp-level actions. The NVD/CNA record rates it CVSS 8.6 (High) while the project labels it critical; exploitation requires a network of two or more linked servers. It is one of nine issues fixed in UnrealIRCd 6.2.7.1 and in the no-restart hot-patch bundle released on 7 November 2026 (forums.unrealircd.org). The project found the flaw during an internal audit carried out with the help of AI.

Entenda a falha

A vulnerabilidade

CVE-2026-114713 is a flaw in the labeled-response module of UnrealIRCd, the open-source IRC server. The module does not escape the IRCv3 label message tag when echoing it into replies. An ordinary user can inject extra protocol lines that linked servers run as server-to-server commands with server authority, which allows KILL, GLINE and other IRCOp-level actions. It only works on a network with two or more linked servers. Affected: UnrealIRCd 6.0.0 through 6.2.7, and UnrealIRCd 5 (end of life since 1 July 2023) is described as similarly affected; 3.2.x and 4 were not assessed. Fixed in 6.2.7.1 and the hot-patch bundle-20261107. The CVE record gives CVSS 8.6 (High), while the project calls it critical.

Como funciona

A user sends a message carrying an IRCv3 label tag to a server with labeled-response enabled. The module builds its reply and copies the label value into it as received. If the label contains line breaks and extra protocol lines, those lines become part of the output. Because the reply goes through the server link, the linked peers read the extra lines as commands from a trusted server. This is where it goes wrong: the remote servers run them with server authority instead of treating them as user input.

Por que é vulnerável

The root cause is missing output sanitisation: the label tag is untrusted user input, but the module echoes it into replies without escaping it. This is combined with the trust model of server links, where commands arriving from a linked peer are accepted as authoritative. The articles say the project found it in an internal audit done with the help of AI. The fix and the spamfilter workaround block invalid labels, but the articles do not describe the code change in detail.

Onde está

The labeled-response module of UnrealIRCd; no article names a file, function or public commit for the fix.

Como foi descoberta

According to the articles, the UnrealIRCd team found the bug during an internal audit carried out with the help of AI. The project announced it on its official forum on 7 November 2026 together with 6.2.7.1 and the hot-patch, among nine fixed issues. It later updated the announcement to say attackers are exploiting it on the internet, quoting "we are seeing bad guys exploiting this issue on the internet right now".

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

No article mentions a published proof of concept. The project says exploitation is happening in the wild, so a working exploit exists in attackers' hands, but no public copy is cited. Treat patching as urgent: apply the spamfilter workaround first, then hot-patch or upgrade.

Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 23:16.

Detalhes técnicos

The labeled-response module does not sanitise the IRCv3 label tag before echoing it into replies, so a crafted label can carry line breaks and additional protocol lines. Because commands arriving from a linked peer are trusted, the injected lines are executed with server authority on remote servers (vuldb.com). Affected: UnrealIRCd 6.0.0 through 6.2.7; UnrealIRCd 5 (EOL since 1 July 2023) is similarly affected; 3.2.x and 4 were not assessed. The other eight issues fixed are two IP address leaks (one allowing user decloaking), crashes in CHGIDENT and whowasdb, a blacklist recheck that can hang the server, a counting bug locking out new connections, a cap on bans set by Services and a TLS renegotiation flood fix.

Detalhes da correção

The project released UnrealIRCd 6.2.7.1 together with the hot-patch bundle bundle-20261107, announced on the official forum on 7 November 2026 at 15:00 UTC; the hot-patch applies all nine fixes without a restart on 6.0.0–6.2.7 (forums.unrealircd.org). No public pull request or commit for the fix is named in the project announcement.

Remediação

  1. As IRCOp, apply the project's spamfilter workaround blocking invalid labels — it protects all linked servers running 6.0.4 or newer against the critical flaw. 2. Run ./unrealircd hot-patch bundle-20261107 on every server, or upgrade to 6.2.7.1 and restart. 3. Verify with MODULE -all (locally and against remote servers) that labeled-response reports the patch bundle or 6.2.7.1 (forums.unrealircd.org). 4. UnrealIRCd 5 and other EOL installs should blacklist the labeled-response module and restart, then migrate to version 6.

Linha do tempo

  1. securityonline.info ↗ · pub. 08/11/2026 22:59 · coletado 08/11 23:00 primeiro registro

    UnrealIRCd CVE-2026-114713 exploited in the wild: label tag injection lets any user run commands with server authority

    ler a análise desta fonte

    The UnrealIRCd project reports active in-the-wild exploitation of CVE-2026-114713, a flaw it calls the most critical found in the IRC daemon in 15 years. The bug lives in the labeled-response module, which fails to escape the IRCv3 label message tag when echoing it back into replies, letting an ordinary user inject extra lines that linked servers execute as server-to-server commands with server authority — enabling KILL, GLINE and other IRCOp-level actions. The NVD/CNA record rates it CVSS 8.6 (High) while the project labels it critical; exploitation requires a network of two or more linked servers. It is one of nine issues fixed in UnrealIRCd 6.2.7.1 and in the no-restart hot-patch bundle released on 7 November 2026 (forums.unrealircd.org). The project found the flaw during an internal audit carried out with the help of AI.

    Technical Details

    The labeled-response module does not sanitise the IRCv3 label tag before echoing it into replies, so a crafted label can carry line breaks and additional protocol lines. Because commands arriving from a linked peer are trusted, the injected lines are executed with server authority on remote servers (vuldb.com). Affected: UnrealIRCd 6.0.0 through 6.2.7; UnrealIRCd 5 (EOL since 1 July 2023) is similarly affected; 3.2.x and 4 were not assessed. The other eight issues fixed are two IP address leaks (one allowing user decloaking), crashes in CHGIDENT and whowasdb, a blacklist recheck that can hang the server, a counting bug locking out new connections, a cap on bans set by Services and a TLS renegotiation flood fix.

    Fix Details

    The project released UnrealIRCd 6.2.7.1 together with the hot-patch bundle bundle-20261107, announced on the official forum on 7 November 2026 at 15:00 UTC; the hot-patch applies all nine fixes without a restart on 6.0.0–6.2.7 (forums.unrealircd.org). No public pull request or commit for the fix is named in the project announcement.

    Remediation

    1. As IRCOp, apply the project's spamfilter workaround blocking invalid labels — it protects all linked servers running 6.0.4 or newer against the critical flaw. 2. Run ./unrealircd hot-patch bundle-20261107 on every server, or upgrade to 6.2.7.1 and restart. 3. Verify with MODULE -all (locally and against remote servers) that labeled-response reports the patch bundle or 6.2.7.1 (forums.unrealircd.org). 4. UnrealIRCd 5 and other EOL installs should blacklist the labeled-response module and restart, then migrate to version 6.