CVE-2026-114713: Security vulnerability
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UnrealIRCdto a version that resolves this vulnerability.Fixed in 6.2.7.1 - Upgrade
Upgrade
UnrealIRCdto a version that resolves this vulnerability.Patch bundle-20261107
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
UnrealIRCd versions 6.0.0 through versions before 6.2.7.1 are affected when the network has two or more linked servers. A single-server network does not meet the stated prerequisite.
What access does an attacker need?
Any user on an affected qualifying network can exploit the issue. The description does not state that operator privileges, authentication beyond normal user access, or access to a linked server is required.
What is the impact of successful exploitation?
An attacker can inject server-to-server commands through an unescaped IRCv3 label message tag. Those commands are executed with server authority.