Severity: High | Priority: 1
CVE-2026-114713 is a vulnerability in the labeled-response module of UnrealIRCd, a widely used open-source IRC server. The module fails to handle a client-supplied message tag safely. On networks where two or more UnrealIRCd servers are linked, an ordinary connected user can use this to inject commands that the linked servers treat as coming from a trusted server. That effectively gives the attacker server-level or IRC operator authority over the network. The UnrealIRCd team has confirmed exploitation in the wild, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog.
Versions 6.0.0 through 6.2.7 are affected, as is the end-of-life UnrealIRCd 5. Single, unlinked servers are not exposed to the server-to-server injection, but should still be updated.
If you run UnrealIRCd in your network, upgrade to 6.2.7.1, which fixes this and several other flaws, or apply the project’s no-restart hot-patch bundle. Then confirm the labeled-response module reports the patched version. UnrealIRCd 5 installations should disable the labeled-response module and restart, then move to version 6. Afterwards, review server and operator logs for unexpected server-originated commands, such as user kills, bans, operator privilege changes or configuration changes that no administrator carried out.