Threat watch / Vulnerability
UnrealIRCd: any chat user can send commands with server authority, and attackers are using it
CVE-2026-114713 is a flaw in the labeled-response module of UnrealIRCd, an open-source IRC chat server. On a network with two or more linked servers, an ordinary user can inject server-to-server commands, which UnrealIRCd says lets normal users execute commands with server or IRCOp authority. The project fixed it on November 7, 2026 in version 6.2.7.1 and a hot-patch, then reported attacks in the wild. CISA added it to its catalog of exploited flaws on November 13.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- UnrealIRCd
- How it happened
- The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when it echoes it into replies. On a network with two or more linked servers, any user can use this to inject server-to-server commands that run with server authority (CVSS 8.6). UnrealIRCd says the flaw "allows normal users to execute commands with server/IRCOp authority".[1][2][3] Checked 14 Nov 2026
- What was stolen
- Not public yet Checked 14 Nov 2026
- Who was impacted
- Operators of UnrealIRCd networks with linked servers running a version before 6.2.7.1 without the hot-patch. The project reports active exploitation but no number of affected networks or named victims has been published.[1][2][3] Checked 14 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-114713
Timeline
- UnrealIRCd releases version 6.2.7.1 and a hot-patch that fix 9 security issues, including the critical CVE-2026-114713. It says that on almost all UnrealIRCd 6 networks the issues can be hot-patched without a restart. [1]
- SecurityOnline reports the project's warning that "we are seeing bad guys exploiting this issue on the internet right now", and its advice to add a spamfilter rule that blocks invalid labels as a stopgap. [3]
- CISA adds CVE-2026-114713 to its Known Exploited Vulnerabilities catalog, giving US federal agencies until November 16, 2026 to fix it. The Hacker News reports that exploitation attempts began a day after the hotfix was released. [2]