CVE-2026-114713: UnrealIRCd Labeled-Response Tag Injection Lets Any User Run Server-to-Server Commands

Background

UnrealIRCd is an open-source IRC server; its vendor describes it as the most widely deployed IRCd, citing a 38% market share (a vendor claim we did not verify). IRC networks usually consist of several servers linked together and exchange server-to-server (S2S) protocol lines; our inference is that linked servers trust those lines. CVE-2026-114713 is in the labeled-response module, which implements the IRCv3 labeled-response specification: a client attaches a label message tag to a command and the server echoes that label in its replies.

The CVE record states that UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the label tag when echoing it into replies. CISA added the CVE to KEV on 13 November 2026. The 6.2.7.1 release fixes nine security issues. The vendor’s news page describes the issue as the “critical issue” in the 6.2.7.1 security release and says it “allows normal users to execute commands with server/IRCOp authority”.

Technical Mechanism

The weakness is classed as CWE-140 (Improper Neutralization of Delimiters). Per the CVE record, the module’s label handling (labeled_response_mtag_is_ok() in src/modules/labeled-response.c) does not escape the tag value before it is placed into replies. The CVE record says that on a network with two or more linked servers, any user can inject S2S commands “executed with server authority”. Our inference, from CWE-140 and the CVE text and not a vendor statement, is that a crafted label carries delimiters that end the intended line and start a new one, which a linked server then parses as a server command.

The attacker needs only an ordinary IRC connection that can send a message tag. Per the CVE description no operator privileges are required. A single-server network is outside the stated condition (two or more linked servers). We did not reproduce the issue. As of 14 November 2026 we found no public proof-of-concept in the CVE record, the KEV entry or the vendor news page (we did not search exploit sites).

The CVE record (assigner mitre) carries CVSS 3.1 base 8.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. NVD lists the same 8.6 as a secondary score from [email protected]; NVD had not completed its own analysis when checked on 14 November 2026. The vendor’s own wording is “critical”, so the vendor severity and the CVSS rating differ.

Real-World Exploitation Evidence

• CISA added CVE-2026-114713 to KEV on 13 November 2026 with a due date of 16 November 2026. The KEV entry sets the forensic triage field to “Yes” and the ransomware field (“knownRansomwareCampaignUse”) to “Unknown”.
• The KEV entry cites the vendor forum announcement. We could not open that forum page (it sits behind a bot check), so details of exploitation beyond the KEV listing are unverified.
• As of 14 November 2026 we found no named threat actor or campaign in the KEV entry, the CVE record or the vendor news page.

Impact Assessment

Commands run with server authority bypass the checks applied to ordinary users. The CVSS vector reflects integrity impact only (C:N/I:H/A:N, scope changed). In practice, our judgement is that server-level command execution on an IRC network lets an attacker alter channel and user state, impersonate users or services, and affect other linked servers. The CVE record does not state operating-system code execution, and we do not claim it.

Networks that link servers, including public networks and community networks with services, are the exposed population. Admins should assume the S2S channel is the trust boundary being crossed.

Affected Versions

UnrealIRCd 5 and earlier are not covered by the CVE record’s wording, which names the 6.0.0 start. Confirm against the vendor announcement for older branches.

Remediation Steps

1. Upgrade to UnrealIRCd 6.2.7.1 or later.
2. If you cannot restart, apply the vendor hot-patch on each server: ./unrealircd hot-patch bundle-20261107. The vendor says most UnrealIRCd 6 networks can be hot-patched without restart.
3. Patch every linked server, not only the one users connect to. Workaround until patched, per the CVE record: add blacklist-module "labeled-response"; to the configuration file of all servers.
4. Follow CISA’s KEV instructions and BOD 26-04 forensic triage requirements, given the 16 November due date.

Detection Guidance

These are suggestions, not vendor-published signatures.

• Review server logs and ircd.log for label tags containing carriage return, line feed or unusual delimiter characters, and for unexpected S2S commands originating from a user connection.
• Look for unexplained changes in channel modes, user modes, server-originated notices or services-style commands.
• Compare configuration state against a known-good copy on each linked server.
• Because the KEV entry requires forensic triage, preserve logs before patching restarts or rotates them.

Timeline

References

• UnrealIRCd news
• UnrealIRCd forum announcement
• CVE record
• NVD: CVE-2026-114713
• CISA KEV catalog