ALPINE-CVE-2026-114713: High severity alpine/unrealircd vulnerability

Q: Which deployments are exposed to server-authority command injection?

UnrealIRCd deployments running a version before 6.2.7.1 are affected when the network has two or more linked servers. A single-server network does not meet the stated condition for exploitation.

Q: What access does an attacker need?

The attacker only needs to be a user on the affected IRC network. The vector is network-accessible, requires no privileges or user interaction, and has low attack complexity.

Q: What is the remediation target?

Upgrade UnrealIRCd to 6.2.7.1 or later. The affected range begins at UnrealIRCd 6.0.0 and includes versions before 6.2.7.1.

Published Nov 8, 2026

Updated

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.

Affected Software

1 affected componentFixes available

alpine/unrealircd<6.1.10-r1

6.1.10-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/unrealircd to a version that resolves this vulnerability.
Fixed in 6.1.10-r1

Event History

Nov 8, 2026

CVE Published

via OSV·03:16 AM

Data Sourced

via OSV·03:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to server-authority command injection?

UnrealIRCd deployments running a version before 6.2.7.1 are affected when the network has two or more linked servers. A single-server network does not meet the stated condition for exploitation.

What access does an attacker need?

The attacker only needs to be a user on the affected IRC network. The vector is network-accessible, requires no privileges or user interaction, and has low attack complexity.

What is the remediation target?

Upgrade UnrealIRCd to 6.2.7.1 or later. The affected range begins at UnrealIRCd 6.0.0 and includes versions before 6.2.7.1.

ALPINE-CVE-2026-114713: High severity alpine/unrealircd vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to server-authority command injection?

What access does an attacker need?

What is the remediation target?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to server-authority command injection?

What access does an attacker need?

What is the remediation target?