# CVE-2026-114713: UnrealIRCd labeled-response command injection

Source: https://junglewise.ai/threats/cve-2026-114713-the-labeled-response-module-in-unrealircd-6-0-0-before-6-2-7-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-114713 · Severity: high · CVSS 8.6 · Published 2026-11-08

UnrealIRCd is an IRC server that powers thousands of chat networks. A flaw in the labeled-response module allows any user on a network with linked servers to inject commands that execute with full server authority, enabling account takeovers, network compromise, and arbitrary malicious actions.

Technologies: [Unrealircd](https://junglewise.ai/threats/technologies/unrealircd). Vendors: [Unrealircd](https://junglewise.ai/threats/vendors/unrealircd).

## Quick answers

**Is CVE-2026-114713 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114713 being exploited in the wild.

**How severe is CVE-2026-114713?** High severity, with a CVSS score of 8.6, published 8 November 2026.

**Which products and versions are affected?** Unrealircd 6.0.0 before 6.2.7.1.

**Is there a fix for CVE-2026-114713?** Yes: fixed in UnrealIRCd 6.2.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114713 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-114713?** Check whether you run Unrealircd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in UnrealIRCd 6.2.7.1

## Technical details

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 fails to escape the IRCv3 "label" message tag when echoing it into server replies, enabling injection of server-to-server commands. An attacker on a linked server can craft a malicious label tag that breaks out of the reply context and injects arbitrary commands executed with server authority, bypassing normal access controls.

## Affected products

- UnrealIRCd UnrealIRCd 6.0.0 before 6.2.7.1

## Timeline

- 2026-11-08: disclosed
- 2026-11-07: patched

## References

- [https://forums.unrealircd.org/viewtopic.php?t=9487](https://forums.unrealircd.org/viewtopic.php?t=9487)
- [https://www.unrealircd.org/](https://www.unrealircd.org/)

## Related threats

- [UnrealIRCd webserver HTTP header denial of service](https://junglewise.ai/threats/cve-2026-90668-unrealircd-webserver-http-header-denial-of-service)
- [UnrealIRCd authentication bypass in SASL module](https://junglewise.ai/threats/cve-2016-7144-unrealircd-authentication-bypass-in-sasl-module)