UnrealIRCd (6.0.0 - 6.2.7.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/unrealircd-6.0.0---6.2.7.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 08:31:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnrealIRCd: Command injection in labeled-response module (CVE-2026-114713)https://feed.craftedsignal.io/briefs/2026-11-unrealircd-rce/Sun, 08 Nov 2026 08:31:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-unrealircd-rce/A command injection vulnerability in the UnrealIRCd labeled-response module allows unauthenticated attackers on linked networks to execute server-to-server commands with elevated authority via unescaped IRCv3 label tags.CVE-2026-114713 is a command injection vulnerability affecting the labeled-response module in UnrealIRCd versions 6.0.0 through 6.2.7.0. The vulnerability occurs because the application fails to properly escape IRCv3 "label" tags when echoing them into server replies. On networks with two or more linked servers, an attacker can leverage this flaw to inject arbitrary server-to-server commands that execute with the authority of the server. This vulnerability carries a CVSS score of 8.6.

Impact

Successful exploitation allows for the execution of unauthorized server-to-server commands, potentially leading to full network compromise, unauthorized modifications to IRC services, or service disruption, as commands are processed with server-level privileges.

Recommendation

  • Upgrade all UnrealIRCd instances to version 6.2.7.1 or later immediately to address the insecure handling of IRCv3 tags.
  • Audit server-to-server (S2S) traffic logs for unusual command patterns or syntax deviations in label-related messages.
  • For environments unable to patch immediately, isolate linked IRC servers to restrict the potential blast radius of server-to-server command injection.
]]>highadvisory