UnrealIRCd Vulnerability CVE-2026-114713 Exploited in the Wild, Lets Users Run IRCOp Commands
Do Son 
TL;DR
The UnrealIRCd team says attackers are now exploiting CVE-2026-114713, a critical flaw in the open-source IRC server. “We are seeing bad guys exploiting this issue on the internet right now,” the project warned. This UnrealIRCd vulnerability lets any ordinary user run commands with server or IRC operator authority.
CVE-2026-114713 lets normal users inject server-to-server commands through the labeled-response module. It is one of nine flaws fixed in UnrealIRCd 6.2.7.1 and a no-restart hot-patch. Apply the spamfilter workaround now, then hot-patch or upgrade.
- CVE: CVE-2026-114713
- CVSS: 8.6 (High · CVSSv3)
- Product: UnrealIRCd
- Affected: < 6.2.7.1
- Impact: CWE-140
- Status: Exploited in the wild
- Patched in: 6.2.7.1
- EPSS: 0.3% (30-day)
- Action: Update to 6.2.7.1 now
Why It Matters
The project calls this “the most critical issue found in UnrealIRCd in the past 15 years.” With it, “any ordinary user can KILL, GLINE, and do many more bad things.” In other words, a stranger could disconnect users, ban them from the network or take other operator actions.
Notably, the team found the bug during an internal audit “with the help of AI.” The project later added an update confirming live attacks, so unpatched networks face real risk.
How the Attack Works
The flaw sits in the labeled-response module. According to the CVE record, it “does not escape the IRCv3 ‘label’ message tag when echoing it into replies.” As a result, a user can slip extra lines into those replies. Linked servers then treat them as server-to-server commands and run them “with server authority.”
The attack needs a network with two or more linked servers. The CVE record rates it CVSS 8.6, while the project labels it critical.
The other eight fixes
- Two IP address leaks, including one that lets users “decloak” others
- Crashes on CHGIDENT and whowasdb
- A blacklist recheck that could hang the server
- A counting bug that can lock out new connections
- A cap on bans set by Services, and a TLS renegotiation flood fix
Affected Versions
- UnrealIRCd 6.0.0 through 6.2.7
- UnrealIRCd 5, which reached end of life on July 1, 2023, is “similarly affected”
- Older releases such as 3.2.x and 4 were not checked
Patch and Mitigation
- Apply the workaround: as an IRCOp, add the project’s spamfilter rule that blocks invalid labels. It protects all linked servers on 6.0.4 or newer against the critical flaw.
- Hot-patch: run the hot-patch bundle-20261107 command on every server. It fixes all nine issues without a restart on 6.0.0 to 6.2.7.
- Or upgrade: install 6.2.7.1 from the official UnrealIRCd site and restart.
- Verify: check that the labeled-response module shows the patch bundle or 6.2.7.1.
UnrealIRCd 5 users should blacklist the labeled-response module and restart, then move to version 6. Because this UnrealIRCd vulnerability is exploited in the wild, admins should act today.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
