L4 · Septic Tank Blewunrealircd · irc · injection · exploitedunrealircd-label-injection

UnrealIRCd label injection lets ordinary users run privileged IRC commands

Attackers are exploiting CVE-2026-114713 to inject server-to-server commands from ordinary client connections on linked UnrealIRCd networks. Version 6.2.7.1 and the November 7 hot-patch fix the injection and eight other security issues.

Disclosed: Nov 7, 2026; Public disclosure date
Severity: CVSS 8.6; 1 CVE tracked here
Splash zone: Unpatched UnrealIRCd 6 and 5 networks with two or more linked servers and the labeled-response module.; unrealircd · irc · injection · exploited
In the wild: Yes; The UnrealIRCd maintainer reported active exploitation on November 8.

What happened

A client connected to a vulnerable IRC network can send a crafted IRCv3 label tag. The labeled-response module carries unescaped delimiters into a reply passed between servers, where the receiving server interprets them as additional IRC commands. This path requires at least two linked servers. The injected IRC commands run with server authority. A client can disconnect other users with KILL or apply network-wide bans with GLINE.

The project calls the injection critical, while the MITRE record scores it 8.6 under CVSS 3.1. The maintainer confirmed exploitation on November 8 without publishing a victim count or attack indicators. The other eight fixes address two ways to expose users’ IP addresses, a hang during blacklist rechecks, a crash involving services’ CHGIDENT, incorrect full-server responses to new connections, excessive bans set by services, potential TLS renegotiation flooding and a possible crash in the WHOWAS database. The temporary filter addresses the command injection. Use the full hot-patch or release for the rest of the batch.

What’s in the bowl

CVE-2026-114713CVSS 8.6

IRCv3 label command injection

A crafted label tag can inject IRC commands into traffic between linked servers. An ordinary client can issue commands with server authority, including KILL and GLINE.

Fixed versions

Product	Safe from	Note
UnrealIRCd 6	`6.2.7.1`	Supported. Hot-patch available for 6.0.0 through 6.2.7 on Unix-like systems.
UnrealIRCd 5	No fix	End of life. Disable labeled-response and restart while migrating to 6.2.7.1 or later.

Crime-scene timeline

Nov 4, 2026
Project announces an upcoming security release
The advance notice gives operators time to prepare for a critical fix and hot-patch.
Nov 7, 15:00 UTC
UnrealIRCd ships 6.2.7.1 and the hot-patch
The maintainer discloses the privileged IRC command injection alongside eight other fixes.
Nov 8, 02:31 UTC
CVE record becomes public
MITRE publishes CVE-2026-114713 with CVSS 3.1 score 8.6.
Nov 8, 2026
Maintainer reports active exploitation
The project updates the advisory and urges administrators to deploy protection immediately.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

UnrealIRCd maintainer advisory and exploitation updatePrimaryConfirms exploitation and the affected 5.x series, and gives the filter, hot-patch, upgrade and verification steps.
UnrealIRCd project release noticesPrimaryDates the advance notice and the November 7 security release.
MITRE CVE recordPrimarySpecifies the linked-server prerequisite and CVSS 3.1 score of 8.6. Its narrative describes 6.x and the project also confirms 5.x.
Maintainer's oss-security disclosurePrimaryExplains how unescaped newlines in the label tag allow IRC commands to cross the server link.
UnrealIRCd hot-patch troubleshootingPrimaryExplains how to diagnose a failed hot-patch and when to upgrade the daemon.
GitHub Advisory Database aliasLists GHSA-237f-p9h6-wq4r as an alias of CVE-2026-114713.

Wipe guide

The wipe checklist

0 of 4 sheets used

Deploy the temporary filter if every server supports itWith all linked servers on 6.0.4 or later, run `/SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z)` once as an IRCOp. The network-wide filter covers CVE-2026-114713 only. If any linked server is older than 6.0.4, proceed directly to patching or upgrading the vulnerable nodes.
Hot-patch or upgrade every affected serverOn Unix-like systems running 6.0.0 through 6.2.7, run `./unrealircd hot-patch bundle-20261107` on every affected server and check that installation and rehash succeeded. On Windows, or if hot-patching fails, upgrade to 6.2.7.1 or later and restart. On Unix-like systems use `./unrealircd upgrade` or install the official release. On Windows use the project's installer. The project FAQ under Hot-patching failed covers build failures after a system upgrade.
Verify each node and investigate unexpected privileged commandsOn 6.0.2 or later, run `./unrealircd module-status | grep labeled-response`. Check for `5.0-hot-patch-bundle-20261107` or the fixed release's module version, such as `6.2.7.1`. A bare `5.0` indicates the bundle is missing. If the shell check is unavailable or empty, use `/MODULE -all` as IRCOp, or `/MODULE -all remote.server.name` for a linked node. If verification fails, upgrade and recheck. Review available operator and server logs for unexplained KILLs or GLINEs. These commands also have legitimate uses.
Contain and replace unsupported serversFor UnrealIRCd 5, add `blacklist-module "labeled-response";` to the configuration on every server and restart each process. A rehash alone leaves the module active. Move unsupported releases to 6.2.7.1 or later. The maintainer did not test other end-of-life series.