# UnrealIRCd before 6.2.7.1: any normal user can run commands with server/IRCOp authority (critical CVE-2026-114713) plus 8 more fixes · pwn.watch > UnrealIRCd released 6.2.7.1 and a no-restart hot-patch (bundle-20261107) on Nov 7 2026 fixing 9 security issues found in an AI-assisted internal audit. The critical one, CVE-2026-114713, is in the labeled-response module, which does not escape the IRCv3 "label" message tag when echoing it into replies; on a network with two or more linked servers any ordinary user can inject server-to-server commands that run with server or IRCOp authority (KILL, GLINE and more). Maintainer Syzop calls it the most critical issue found in UnrealIRCd in the past 15 years. The other 8 fixes cover two IP-address leaks (including "decloaking" another user), a blacklist-recheck hang, a user-triggerable crash on CHGIDENT from Services, a counting error that can lock out all new connections with "This server is full", no cap on how many bans Services can set (now 2x set::maxbans), a TLS renegotiation flood issue and a possible whowasdb crash. UnrealIRCd 5 (end of life since 2023) is also affected by the critical bug. Apply the SPAMFILTER workaround first, then hot-patch or upgrade. Page: https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713 · generated 2026-11-08T04:16:13.100Z ## Status - Severity: critical · status: live · patch: patched - Product: UnrealIRCd - Started: 2026-11-07 - CVEs: CVE-2026-114713 - Affected: UnrealIRCd 6.0.0 through 6.2.7; UnrealIRCd 5 (end of life, also affected by the critical issue; no fix, workaround only); Older end-of-life versions (3.2.x, 4) not checked by the vendor; several of the other bugs likely go back to 3.2.x - Fixed in: UnrealIRCd 6.2.7.1; UnrealIRCd 6.0.0–6.2.7 with hot-patch bundle-20261107 (./unrealircd hot-patch bundle-20261107, no restart) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713/feed.xml - JSON Feed: https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713.json - This file: https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713/llms.txt ## Updates (newest first) - 2026-11-08: MITRE publishes CVE-2026-114713 (CVSS 3.1 8.6): the labeled-response module does not escape the IRCv3 label tag, letting any user on a network with two or more linked servers inject server-to-server commands executed with server authority. (https://www.cve.org/CVERecord?id=CVE-2026-114713) - 2026-11-07: UnrealIRCd releases 6.2.7.1 and hot-patch bundle-20261107 fixing 9 security issues, including critical CVE-2026-114713 (normal users can execute commands with server/IRCOp authority), and publishes a SPAMFILTER workaround that protects networks whose servers are all on 6.0.4 or newer. (https://forums.unrealircd.org/viewtopic.php?t=9487) - 2026-11-07: UnrealIRCd says UnrealIRCd 5 (EOL since 2023-07-01) is also affected by the critical bug; the workaround there is adding blacklist-module "labeled-response" to the config on all servers and restarting them. (https://x.com/Unreal_IRCd/status/2119087387825619024) ## Fix brief # Security brief: UnrealIRCd before 6.2.7.1: any normal user can run commands with server/IRCOp authority (critical CVE-2026-114713) plus 8 more fixes Source: https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713 · status: live · severity: critical · updated Nov 8, 2026, 03:30 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is UnrealIRCd released 6.2.7.1 and a no-restart hot-patch (bundle-20261107) on Nov 7 2026 fixing 9 security issues found in an AI-assisted internal audit. The critical one, CVE-2026-114713, is in the labeled-response module, which does not escape the IRCv3 "label" message tag when echoing it into replies; on a network with two or more linked servers any ordinary user can inject server-to-server commands that run with server or IRCOp authority (KILL, GLINE and more). Maintainer Syzop calls it the most critical issue found in UnrealIRCd in the past 15 years. The other 8 fixes cover two IP-address leaks (including "decloaking" another user), a blacklist-recheck hang, a user-triggerable crash on CHGIDENT from Services, a counting error that can lock out all new connections with "This server is full", no cap on how many bans Services can set (now 2x set::maxbans), a TLS renegotiation flood issue and a possible whowasdb crash. UnrealIRCd 5 (end of life since 2023) is also affected by the critical bug. Apply the SPAMFILTER workaround first, then hot-patch or upgrade. Severity detail: Vendor rates CVE-2026-114713 CRITICAL (any normal user can execute commands with server/IRCOp authority); the CVE record (MITRE) scores it CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N), CWE-140, on networks with two or more linked servers. The other 8 issues are crashes, hangs, DoS and IP-address leaks. No in-the-wild exploitation reported. - Product: UnrealIRCd - CVE / advisory ids: CVE-2026-114713 ## Affected versions - UnrealIRCd 6.0.0 through 6.2.7 - UnrealIRCd 5 (end of life, also affected by the critical issue; no fix, workaround only) - Older end-of-life versions (3.2.x, 4) not checked by the vendor; several of the other bugs likely go back to 3.2.x ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - UnrealIRCd 6.2.7.1 - UnrealIRCd 6.0.0–6.2.7 with hot-patch bundle-20261107 (./unrealircd hot-patch bundle-20261107, no restart) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes Step 1 (immediate, as an IRCOp): /SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z) — protects the whole network against CVE-2026-114713 only if every linked server is on 6.0.4 or newer. Step 2a (6.0.0–6.2.7 on *NIX, no restart): ./unrealircd hot-patch bundle-20261107, then verify with ./unrealircd module-status|grep labeled-response (expect labeled-response 5.0-hot-patch-bundle-20261107, or 6.2.7.1). Step 2b (Windows, or if hot-patching fails): ./unrealircd upgrade and restart, or download 6.2.7.1. UnrealIRCd 5: add blacklist-module "labeled-response"; to the config on all servers and restart (not rehash), then move to UnrealIRCd 6. ## Latest updates - Nov 8, 2026: MITRE publishes CVE-2026-114713 (CVSS 3.1 8.6): the labeled-response module does not escape the IRCv3 label tag, letting any user on a network with two or more linked servers inject server-to-server commands executed with server authority. - Nov 7, 2026: UnrealIRCd releases 6.2.7.1 and hot-patch bundle-20261107 fixing 9 security issues, including critical CVE-2026-114713 (normal users can execute commands with server/IRCOp authority), and publishes a SPAMFILTER workaround that protects networks whose servers are all on 6.0.4 or newer. - Nov 7, 2026: UnrealIRCd says UnrealIRCd 5 (EOL since 2023-07-01) is also affected by the critical bug; the workaround there is adding blacklist-module "labeled-response" to the config on all servers and restarting them. ## Advisories - [UnrealIRCd 6.2.7.1 released & hot-patch to fix 9 security issues, including one CRITICAL (CVE-2026-114713)](https://forums.unrealircd.org/viewtopic.php?t=9487) (UnrealIRCd) - [CVE-2026-114713 record (CVSS 3.1 8.6, CWE-140)](https://www.cve.org/CVERecord?id=CVE-2026-114713) (CVE.org) --- Machine-readable: https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.