CVE-2026-114713: UnrealIRCd Label Tag Injection Hits CISA KEV

CISA added CVE-2026-114713 to the Known Exploited Vulnerabilities catalog on November 13, 2026, with a remediation due date of November 16. UnrealIRCd maintainer Bram Matthys disclosed the bug on November 8: before version 6.2.7.1, the labeled-response module does not escape IRCv3 label message tags when echoing them into replies. On any network with two or more linked servers, a normal user can inject server-to-server commands that run with server or IRC operator authority. The forum advisory UPDATE reports active exploitation on the internet; CISA KEV added the CVE November 13, 2026.

If you run UnrealIRCd 6 on a linked network, treat this as patch-now, not queue-for-weekend: apply the IRCOp spamfilter workaround, then hot-patch or upgrade to 6.2.7.1 on every node.

TL;DR

What failed in labeled-response

GitHub advisory GHSA-237f-p9h6-wq4r summarizes the mechanism: the labeled-response module implements IRCv3 labeled client requests. When the server echoes the client's label tag into a reply, it must treat tag contents as opaque text. Instead, 6.0.0 through versions before 6.2.7.1 allow newline (\n) and other delimiter bytes inside the label to break out of the tag context.

IRC is a line-oriented text protocol. Server-to-server traffic uses the same framing. Injecting raw newlines into traffic that peers parse as server commands means an unprivileged nickname can emit lines such as KILL, GLINE, or other IRC operator / services actions as if they originated from a trusted server. Matthys calls it the most critical UnrealIRCd issue in roughly 15 years.

The weakness class on CISA KEV is CWE-140 (Improper Neutralization of Delimiters). Exploitation requires network reachability to IRC and a multi-server topology; a lone standalone server without links removes the server-to-server injection path, but the same release still bundles eight additional security fixes (IP decloak, hangs, crashes, TLS edge cases) you only get from the hot-patch bundle or 6.2.7.1.

How the maintainer found it

In the oss-security post, Matthys describes an internal audit assisted by AI that surfaced nine issues in one pass, then shipped a hot-patch bundle so most networks could fix without a full restart. That discovery story matters for developer-machine risk in a different way than the IRC bug itself: teams increasingly use coding agents to audit C and daemon code. A project that has not shipped defensive fixes recently may simply not have been reviewed with modern tooling, whether by defenders or attackers. The vendor's closing section warns explicitly that end-of-life UnrealIRCd 3.2.x, 4, and 5 likely carry unfixed variants of bugs fixed only in 6.2.7.1.

For broader CVE triage context when your feed spikes, see CVE volume in 2026 and Barracuda's KEV chain as examples of how CISA due dates now track exploitation, not just CVSS.

Attack chain step by step

From the vendor description and advisory text, defenders should model this chain:

1. Attacker joins as a normal IRC user on any server that is linked to at least one other UnrealIRCd 6 server.

2. Client sends a labeled IRCv3 request carrying a crafted label tag whose value contains unescaped newlines or delimiters.

3. labeled-response echoes the tag into a server-generated reply without neutralizing those bytes.

4. Linked servers parse injected lines as server-to-server protocol, executing them with server authority (for example mass KILL, GLINE, or other privileged actions Matthys lists).

5. Follow-on abuse can include denial of service, network-wide bans, or chaining to other bugs fixed in the same bundle (IP decloak issues also disclosed in the same release).

This is not prompt injection and not an agent SDK flaw. It is delimiter injection in a privilege boundary between user messages and inter-server control plane traffic, similar in spirit to command injection on appliances where a low-trust input reaches a high-trust parser.

Who is affected and what to install

CISA's KEV entry names UnrealIRCd broadly and points operators to the vendor forum advisory (same text as oss-security). BOD 26-04 federal agencies must act by November 16, 2026; private teams should treat KEV membership as exploitation confirmed regardless of sector.

Mitigation and verification commands

Work in the vendor's order: workaround first, then hot-patch or upgrade.

Step 1 — spamfilter workaround (IRCOp, all linked servers on 6.0.4+)

From the oss-security copy of the advisory, run as IRC operator on the network:

/SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z)

This blocks the critical label injection pattern but does not remediate the other bundled issues, and requires every linked server to be 6.0.4 or newer for full protection.

Step 2a — hot-patch without restart

On each *NIX server running 6.0.0 – 6.2.7:

./unrealircd hot-patch bundle-20261107

Success should end with "Patch installed and server rehashed correctly. All should be good now!" (wording varies slightly on older 6.0.x). If hot-patch fails, use vendor FAQ hot-patch failed or upgrade instead.

Verify on 6.0.2+:

./unrealircd module-status | grep labeled-response

Expected safe outputs include labeled-response 5.0-hot-patch-bundle-20261107 or 6.2.7.1. Only 5.0 without the bundle means the patch did not apply.

Step 2b — upgrade with restart

./unrealircd upgrade

Then restart the IRC daemon, or download 6.2.7.1 from unrealircd.org. Windows paths should follow the vendor forum instructions if shell hot-patch is unavailable.

UnrealIRCd 5 and other EOL branches

Add to every server config, then restart (not rehash):

blacklist-module "labeled-response";

The vendor states nobody should run UnrealIRCd 5; plan migration to 6.2.7.1+.

What this means if you run AI coding agents

Most Beam readers do not operate public IRC networks. The practical angles on developer laptops and small VPS hosts are narrower but real:

• Inventory before agents "fix" configs. If a repo contains Dockerfiles, Ansible, or cloud-init that install unrealircd, pin 6.2.7.1 and forbid agent PRs that downgrade packages or remove hot-patch steps. Agent-generated infra diffs are a common source of stale image tags, similar to Aspire dashboard pins stuck below a security floor.

• Do not expose IRC to the internet while patching. Even with the spamfilter workaround, incomplete coverage across linked servers leaves gaps. Treat public 6667/6697 exposure like any other admin surface you would not give a coding agent permission to open casually.

• Separate "interesting research" from production. Matthys's note that AI audits found nine bugs is a signal to schedule reviews on any long-lived daemon you still run for legacy chat, CI bots, or internal community tools, not a reason to defer patching because "AI will find the next one."

• KEV triage for agents that read security mail. If your agent ingests CISA feeds or vendor lists, prioritize KEV + due date over raw CVE count, consistent with October's CVE volume guidance.

Beam does not scan or patch UnrealIRCd binaries. If you use Claude Code or Codex with enforce policy on the same host that holds IRC TLS keys, Beam's PreToolUse deny hooks can block matched destructive shell patterns agents might run after reading a public exploit write-up, but they do not harden the IRC daemon itself.

The other eight fixes in the same release

Matthys bundled nine security fixes in bundle-20261107 and 6.2.7.1. Only item 1 is CVE-2026-114713, but operators who stop after the spamfilter workaround still leave decloak, denial-of-service, and stability holes open:

Treat KEV membership as forcing function for the critical item, but hot-patch or upgrade is the only way to close the full set. Networks that already adopted hot-patching as a release strategy (linked from Matthys's oss-security note) can apply bundle-20261107 without a maintenance window; everyone else should plan a restart upgrade before the next exploitation wave targets secondary bugs.

CISA KEV and BOD 26-04 timing

CISA's catalog row for CVE-2026-114713 lists date added November 13, 2026, due date November 16, 2026, CWE-140, and points to the vendor forum plus BOD 26-04. Federal Civilian Executive Branch systems must patch or discontinue use on that timeline; the Forensics Triage Requirements linked from KEV apply when BOD marks triage yes (CISA lists forensic triage required for this entry).

Private networks still benefit from the same calendar: three days from KEV publication to due date signals active abuse, not theoretical risk. If your vulnerability management agent auto-deprioritizes anything below CVSS 9, note GitHub's scored vector is 8.6 with integrity impact and changed scope—exploitation intelligence trumped the number here.

Frequently asked questions

What is CVE-2026-114713?

It is delimiter injection in UnrealIRCd labeled-response before 6.2.7.1. Crafted IRCv3 label content can break into server-to-server framing so unprivileged users execute server-authority commands on linked networks.

Which versions need action?

6.0.0 through 6.2.7, plus any EOL 5.x still in production. 6.2.7.1 and bundle-20261107 are the vendor-fixed baselines.

Is it exploited?

Yes, per maintainer update text and CISA KEV addition November 13, 2026.

What if hot-patch fails?

Follow UnrealIRCd hot-patch FAQ, then perform step 2b full upgrade. Distro library drift is a common failure mode called out there.

Do coding agents change the fix?

Agents do not patch IRC daemons for you. They can speed discovery of unfixed containers in repos—grep for unrealircd in infra folders after disclosure mail hits your inbox.

Related reading

• CVE volume hit a record in 2026: triage by KEV, not count
• Barracuda ESG chain added to CISA KEV November 10
• Aspire Dashboard CVE-2026-118740: missing auth on admin routes
• AWS MCP Gateway Registry SSRF CVE-2026-125926
• PHP2Shell mechanism for comparison on delimiter-class bugs

Primary sources: oss-security announcement, GHSA-237f-p9h6-wq4r, CISA KEV catalog entry, NVD CVE-2026-114713.

Version numbers, KEV due dates, and hot-patch bundle names are accurate as of November 13, 2026. Confirm against UnrealIRCd's forum advisory before you change production networks.