UnrealIRCd before 6.2.7.1: any normal user can run commands with server/IRCOp authority (critical CVE-2026-114713) plus 8 more fixes
UnrealIRCd
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
UnrealIRCd released 6.2.7.1 and a no-restart hot-patch (bundle-20261107) on Nov 7 2026 fixing 9 security issues found in an AI-assisted internal audit. The critical one, CVE-2026-114713, is in the labeled-response module, which does not escape the IRCv3 "label" message tag when echoing it into replies; on a network with two or more linked servers any ordinary user can inject server-to-server commands that run with server or IRCOp authority (KILL, GLINE and more). Maintainer Syzop calls it the most critical issue found in UnrealIRCd in the past 15 years. The other 8 fixes cover two IP-address leaks (including "decloaking" another user), a blacklist-recheck hang, a user-triggerable crash on CHGIDENT from Services, a counting error that can lock out all new connections with "This server is full", no cap on how many bans Services can set (now 2x set::maxbans), a TLS renegotiation flood issue and a possible whowasdb crash. UnrealIRCd 5 (end of life since 2023) is also affected by the critical bug. Apply the SPAMFILTER workaround first, then hot-patch or upgrade.
Why this severity: Vendor rates CVE-2026-114713 CRITICAL (any normal user can execute commands with server/IRCOp authority); the CVE record (MITRE) scores it CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N), CWE-140, on networks with two or more linked servers. The other 8 issues are crashes, hangs, DoS and IP-address leaks. No in-the-wild exploitation reported.
- Started
- Nov 7, 2026
Affected
- UnrealIRCd 6.0.0 through 6.2.7
- UnrealIRCd 5 (end of life, also affected by the critical issue; no fix, workaround only)
- Older end-of-life versions (3.2.x, 4) not checked by the vendor; several of the other bugs likely go back to 3.2.x
Fixed in
- UnrealIRCd 6.2.7.1
- UnrealIRCd 6.0.0–6.2.7 with hot-patch bundle-20261107 (./unrealircd hot-patch bundle-20261107, no restart)
Timeline3
MITRE publishes CVE-2026-114713 (CVSS 3.1 8.6): the labeled-response module does not escape the IRCv3 label tag, letting any user on a network with two or more linked servers inject server-to-server commands executed with server authority.
UnrealIRCd releases 6.2.7.1 and hot-patch bundle-20261107 fixing 9 security issues, including critical CVE-2026-114713 (normal users can execute commands with server/IRCOp authority), and publishes a SPAMFILTER workaround that protects networks whose servers are all on 6.0.4 or newer.
UnrealIRCd says UnrealIRCd 5 (EOL since 2023-07-01) is also affected by the critical bug; the workaround there is adding blacklist-module "labeled-response" to the config on all servers and restarting them.
Advisories2
Posts2
UnrealIRCd 6.2.7.1 and hot-patch released: this fixes 9 security issues, including 1 CRITICAL (CVE-2026-114713). We suggest first deploying the SPAMFILTER workaround and then running the hot-patch command. See t.co/GWvETmKodm for all details. #IRC
UnrealIRCd 5 is also affected by the critical bug. Other issues go back to 3.2.x. Please understand that running End Of Life versions is a BAD idea. See end of t.co/GWvETmKodm "Note to UnrealIRCd 5 and other EOL versions" and "Final words: the danger of AI is real"
Get an email when a new major security incident drops. No spam, unsubscribe any time.
