UnrealIRCd labeled-response Bug: Active Exploitation Within 24 Hours of Patch

CVE-2026-114713 allows server-to-server command injection on IRC networks with two or more linked servers; CISA mandates federal patching by November 16, 2026.

UnrealIRCd maintainer Bram Matthys called it "the most critical issue found in UnrealIRCd over the past 15 years." CVE-2026-114713 is a command-injection vulnerability in the labeled-response module that lets any ordinary user on an IRC network with two or more linked servers execute server-to-server commands with server authority. The patch landed on November 7, 2026; in-the-wild exploitation began the next day. CISA added the bug to its Known Exploited Vulnerabilities catalog on November 13, setting a binding November 16 deadline for U.S. federal agencies.

Key Takeaways

CVE-2026-114713 carries a CVSS 3.1 score of 8.6 (HIGH) with changed scope, classified as CWE-140 per the official cve.org record
The labeled-response module in UnrealIRCd 6.0.0 through 6.2.7 fails to escape the IRCv3 'label' tag in responses
Any user on a network with two or more linked servers can inject S2S commands executed with server authority
In-the-wild exploitation is confirmed by maintainer Bram Matthys and cataloged by CISA on November 13, 2026
The window between patch release and first active exploitation is a single day

The Mechanism: From Correlation Tag to Injection

The labeled-response module implements the IRCv3 extension for correlating client-server responses via the optional label tag. The client-supplied value is copied into a buffer via strlcpy and reinserted into responses via snprintf. According to Ostorlab's technical analysis, neither operation filters IRC protocol delimiters: carriage return, line feed, semicolon, or space.

An attacker who injects these bytes into the label tag causes premature message termination. Subsequent bytes are interpreted by the peer server as standalone server-to-server commands, executed with the authority of the trusted link. Documented injectable commands include KILL to disconnect arbitrary users, GLINE, KLINE, and TKLINE for network-wide bans, plus server-notice directives.

The vulnerability manifests only on networks with two or more linked servers: an isolated server exhibits incorrect protocol behavior but does not expose the escalation path. This condition appears in the official technical description on cve.org and is confirmed by independent source-code analysis.

Timeline: From AI Discovery to Exploitation

The bug was identified during an internal audit aided by artificial-intelligence tools. The fix commit 05b5f5fdc8bb is dated November 4, 2026, with public release on November 7. Maintainer Bram Matthys stated: "We are seeing bad guys exploiting this issue on the internet right now." The same source reports his severity assessment: "The most critical issue found in UnrealIRCd over the past 15 years."

Exploitation attempts began on November 8, 2026, within the first 24 hours of patch availability. This temporal compression reduces the traditional remediation window to a single day.

"Hopefully everyone has hot-patched or updated their server, or at the very least has the spamfilter workaround deployed. If not, do so ASAP!"
— Bram Matthys (Syzop), UnrealIRCd project leader Note: the maintainer's statements are reported through journalistic sources, not a direct primary source.

Immediate Actions

Update immediately to UnrealIRCd 6.2.7.1, released November 7, 2026 with the complete fix
For installations that cannot update, apply the labeled-response module blacklist workaround in modules.default.conf
Verify the module's presence in your configuration: it loads by default and may be active even without explicit configuration
U.S. federal agencies must comply with Binding Operational Directive 26-04 by November 16, 2026

Analysis: The Tempo of the Threat Landscape

Editorial analysis. CVE-2026-114713 illustrates the gap between traditional development cycles and the speed of today's threat ecosystem. UnrealIRCd is an open-source project with over twenty years of history. Version 6.2.7.1 fixes nine vulnerabilities, yet only this one triggered immediate active exploitation.

Discovery via AI tooling and exploitation within 24 hours signal a shift in the cadence between discovery and weaponization. The labeled-response module, loaded by default, exposes an attack surface that requires no administrator misconfiguration: the vulnerability exists in standard settings.

For organizations running internal IRC networks, the lesson is specific. The protocol is often treated as legacy-safe due to the absence of a web surface or modern APIs; this vulnerability demonstrates that transport-layer security does not mitigate application logic flaws. A client connected to a server linked to a second server forms a chain of trust that the label tag allows an attacker to violate from the lowest rung of the privilege hierarchy.

Context and Sources

The official CVE-2026-114713 record on cve.org assigns a CVSS 3.1 score of 8.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. The CWE-140 classification (Improper Neutralization of Delimiters) describes the parsing flaw in the tag. CISA added the vulnerability to the KEV catalog on November 13, 2026, with two binding dates of November 16 for BOD 26-04.

UnrealIRCd 5.x reached end-of-life on July 1, 2023 and receives no patches; for these installations the only documented mitigation is the module blacklist. The specific fix in commit 05b5f5fdc8bb adds a check in labeled_response_mtag_is_ok() that rejects labels containing space, semicolon, backslash, carriage return, or line feed.

Sources

Sources and references

Get DeafLetter