# UnrealIRCd labeled-response IRCv3 label tag injection (CVE-2026-114713) exploited in the wild

> The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 'label' message tag when echoing it into replies, so any user on a network with two or more linked servers can inject server-to-server commands that run with server authority. The maintainer reports in-the-wild exploitation, and CISA added the flaw to the KEV catalog on 2026-11-13.

- **Published:** 2026-11-14T13:13:31Z
- **Last reviewed:** 2026-11-14T13:13:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6078
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6078.png
- **ID:** TL-2026-6078
- **Severity:** CRITICAL (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 4
- **CVEs:** CVE-2026-114713

## Description

CVE-2026-114713 is an escaping bug in UnrealIRCd's implementation of the IRCv3 'label' message tag (the labeled-response module). When the server echoes the label into a reply, it does not neutralize newline and other delimiter characters. IRC is a line-based text protocol, so an ordinary, unprivileged user can embed extra lines in the label. Linked servers then parse those lines as server-to-server commands and execute them with server authority. The attack needs a network with two or more linked servers. The advisory demonstrates commands such as KILL (disconnecting users) and GLINE (network-wide bans), and the maintainer describes the effect as ordinary users running commands with server/IRCOp authority. The maintainer, Bram Matthys (Syzop), calls it the most critical UnrealIRCd issue in 15 years. CISA labels it 'UnrealIRCd Improper Neutralization of Delimiters Vulnerability'; one secondary source maps it to CWE-140.

Affected versions are UnrealIRCd 6.0.0 through 6.2.7. Version 6.2.7.1 was released as a hotfix on 2026-11-07, and a no-restart hot-patch (bundle-20261107) covers 6.0.0 to 6.2.7 on *NIX. UnrealIRCd 5 (end of life since 2023-07-01) is also affected. Versions 3.2.x and 4 were not checked. The maintainer says several other bugs fixed in the same release probably date back to 3.2.x. The bug was found during an internal audit that the project says was done with AI assistance. The maintainer also warns that unpatched daemons may have been probed by AI-assisted attackers without being reported.

Exploitation: the project states 'We are seeing bad guys exploiting this issue on the internet right now', and The Hacker News reports attempts began about a day after the hotfix. CISA added the flaw to the KEV catalog on 2026-11-13. No threat actor, malware, payload, proof-of-concept, IOC or end goal has been published. No network IOCs exist in the sources, so no BeaconBeagle correlation was possible. The IOC list below holds only defender-relevant artifacts taken from the advisories: remediation markers, module names, abused commands and package names.

The same 6.2.7.1 release fixes eight further issues: a user decloaking IP leak, a second IP leak, a blacklist-recheck hang, a CHGIDENT crash from Services, a counting error causing 'This server is full', Services ban limits, a TLS renegotiation flood, and a possible whowasdb crash. Red Hat also notes CVE-2026-90668, an unlimited HTTP request headers denial of service fixed in the same release. Fedora EPEL 9 still ships unrealircd 6.1.10-1.el9, which is affected.

Source discrepancy: The Hacker News and secondary sources describe a spamfilter workaround, while the maintainer's advisory (oss-sec) gives the spamfilter rule for 6.0.4+ and a blacklist-module workaround for UnrealIRCd 5. The CVSS score of 8.6 is reported without a vector string, and NVD had not enriched the entry at time of research.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1565.002 Transmitted Data Manipulation
- T1595.002 Active Scanning: Vulnerability Scanning

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**UnrealIRCd CVE-2026-114713 labeled-response Label Tag Escape Injection — Exploitation** (`TL-2026-6078-SPL-001`)

Detects plaintext IRC client traffic to an UnrealIRCd listener whose IRCv3 'label' message tag contains IRCv3 escape sequences for CR, LF, ';' or space (backslash-r, backslash-n, backslash-colon, backslash-s). The labeled-response module (6.0.0-6.2.7, and 5.x) unescapes the value and echoes it unneutralized, so these sequences become extra lines that linked servers execute as server-to-server commands (CWE-140, CISA KEV 2026-11-13). Legitimate IRCv3 clients send short alphanumeric label values, so any escape sequence in a label is anomalous. Only plaintext listeners are visible; use the ircd-side detections for TLS listeners such as 6697.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1210, T1565.002
- **Data sources:** splunk_stream:tcp, ircd_plaintext_listener_traffic
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=network sourcetype="stream:tcp" dest_port IN (6667,6668,6669,7000) src_content="*label=*" ```CVE-2026-114713 labeled-response: IRCv3 escapes (backslash r, n, colon, s) inside the label tag value are unescaped and echoed by the server; x5c is a literal backslash``` | regex src_content="(?:^|[@;])label=[^ ;]*\x5c[rn:s]" | rex field=src_content "(?<label_tag>label=[^ ;]*)" | stats count as attempts min(_time) as first_seen max(_time) as last_seen values(label_tag) as label_values by src_ip dest_ip dest_port | convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
IRCRawTraffic_CL
| where TimeGenerated > ago(24h)
| where DstPort_d in (6667, 6668, 6669, 7000)
// CVE-2026-114713: escaped CR/LF/;/space inside the IRCv3 label tag value (x5c = literal backslash)
| where Payload_s matches regex @"(?:^|[@;])label=[^ ;]*\x5c[rn:s]"
| extend LabelTag = extract(@"(label=[^ ;]*)", 1, Payload_s)
| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), LabelValues = make_set(LabelTag, 10) by SrcIP_s, DstIP_s, DstPort_d
| project FirstSeen, LastSeen, SrcIP_s, DstIP_s, DstPort_d, Attempts, LabelValues
```

### Sigma

```yaml
title: UnrealIRCd labeled-response Label Tag Escape Injection (CVE-2026-114713)
id: 6b1f2d3a-7c41-4e8b-9a52-3d0c1e7f8a01
status: experimental
description: Detects an IRCv3 label message tag containing escape sequences for CR, LF, semicolon or space sent to an UnrealIRCd listener. The vulnerable labeled-response module echoes the unescaped value so linked servers parse injected lines as server-to-server commands.
references:
    - https://seclists.org/oss-sec/2026/q4/576
    - https://www.cisa.gov/news-events/alerts/2026/11/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026/11/14
tags:
    - attack.initial-access
    - attack.t1190
    - attack.lateral-movement
    - attack.t1210
    - attack.impact
    - attack.t1565.002
    - cve.2026.114713
logsource:
    product: ircd
    service: raw_traffic
detection:
    selection:
        dst_port:
            - 6667
            - 6668
            - 6669
            - 7000
        payload|re: '(?:^|[@;])label=[^ ;]*\x5c[rn:s]'
    condition: selection
falsepositives:
    - Custom IRC bots or test harnesses that deliberately send escaped characters in label values
    - Vulnerability scanners run by the owning team against the IRC network
level: high
```

**Known false positives:**

- Custom IRC bots or test harnesses that intentionally send escaped characters in label values
- Authorized vulnerability scanning of the IRC network by the owning team

**Tuning notes:** Adjust the dest_port list to the listener ports in your unrealircd.conf and exclude scanner source IPs. TLS-only listeners (6697) are not inspectable without TLS termination; pair with the spamfilter-hit and TKL/KILL ircd-log detections. Once patched (6.2.7.1 or bundle-20261107) keep the rule as a probe indicator.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] CVE-2026-114713 Invalid_label Spamfilter Hit — Blocked Exploitation Attempt (locked: unlock with TL Creds)
- [indicator] CVE-2026-114713 KILL Command Burst via Server Authority — Post-Exploitation (locked: unlock with TL Creds)
- [indicator] CVE-2026-114713 Connection Flood or Multi-Server Sweep on IRC Ports — Recon/Impact (locked: unlock with TL Creds)
- [indicator] CVE-2026-114713 Injected Server Command Inside label Tag — Exploitation (locked: unlock with TL Creds)
- [indicator] Invalid_label Spamfilter Removed — CVE-2026-114713 Mitigation Tampering (locked: unlock with TL Creds)
- [indicator] Daemon Spawning Shell or Download Tool — Post-Exploitation Follow-on (locked: unlock with TL Creds)
- [indicator] CVE-2026-114713 Burst of Global Bans (GLINE/Shun) — Post-Exploitation (locked: unlock with TL Creds)
- [indicator] CVE-2026-114713 Label-Tag Injection Sweep Across Linked Servers — Recon/Lateral (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection](https://thehackernews.com/2026/11/attackers-exploit-unrealircd-flaw-that.html)
- [oss-sec: UnrealIRCd security advisory (CVE-2026-114713), Bram Matthys](https://seclists.org/oss-sec/2026/q4/576)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/11/13/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [Red Hat Bugzilla 2568818 - CVE-2026-114713 unrealircd: command injection via unescaped message tag](https://bugzilla.redhat.com/show_bug.cgi?id=2568818)
- [UnrealIRCd vulnerability CVE-2026-114713 exploited (SecurityOnline)](https://securityonline.info/unrealircd-vulnerability-cve-2026-114713-exploited/)
- [UnrealIRCd Warns CVE-2026-114713 Is Under Attack, Worst in 15 Years (Daily Security Review)](https://dailysecurityreview.com/?p=45510)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6078