CVE-2026-28681

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28681", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-02T21:43:19.927Z", "datePublished": "2026-03-06T04:35:59.899Z", "dateUpdated": "2026-03-06T16:07:02.713Z"}, "containers": {"cna": {"title": "IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-640", "lang": "en", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj"}, {"name": "https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb", "tags": ["x_refsource_MISC"], "url": "https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb"}, {"name": "https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c", "tags": ["x_refsource_MISC"], "url": "https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c"}, {"name": "https://irrd.readthedocs.io/en/stable/releases/4.4.5", "tags": ["x_refsource_MISC"], "url": "https://irrd.readthedocs.io/en/stable/releases/4.4.5"}, {"name": "https://irrd.readthedocs.io/en/stable/releases/4.5.1", "tags": ["x_refsource_MISC"], "url": "https://irrd.readthedocs.io/en/stable/releases/4.5.1"}], "affected": [{"vendor": "irrdnet", "product": "irrd", "versions": [{"version": ">= 4.4.0, < 4.4.5", "status": "affected"}, {"version": ">= 4.5.0, < 4.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T04:35:59.899Z"}, "descriptions": [{"lang": "en", "value": "Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the real IRRD instance to take over the account. A compromised account can then be used to modify RPSL objects maintained by the account's mntners and perform other account actions. If the user had two-factor authentication configured, which is required for users with override access, an attacker is not able to log in, even after successfully resetting the password. This issue has been patched in versions 4.4.5 and 4.5.1."}], "source": {"advisory": "GHSA-22m3-c7vp-49fj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T15:58:15.412745Z", "id": "CVE-2026-28681", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:07:02.713Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28681", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T15:58:15.412745Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T15:58:16.561Z"}}], "cna": {"title": "IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links", "source": {"advisory": "GHSA-22m3-c7vp-49fj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "irrdnet", "product": "irrd", "versions": [{"status": "affected", "version": ">= 4.4.0, < 4.4.5"}, {"status": "affected", "version": ">= 4.5.0, < 4.5.1"}]}], "references": [{"url": "https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj", "name": "https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb", "name": "https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c", "name": "https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c", "tags": ["x_refsource_MISC"]}, {"url": "https://irrd.readthedocs.io/en/stable/releases/4.4.5", "name": "https://irrd.readthedocs.io/en/stable/releases/4.4.5", "tags": ["x_refsource_MISC"]}, {"url": "https://irrd.readthedocs.io/en/stable/releases/4.5.1", "name": "https://irrd.readthedocs.io/en/stable/releases/4.5.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the real IRRD instance to take over the account. A compromised account can then be used to modify RPSL objects maintained by the account's mntners and perform other account actions. If the user had two-factor authentication configured, which is required for users with override access, an attacker is not able to log in, even after successfully resetting the password. This issue has been patched in versions 4.4.5 and 4.5.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T04:35:59.899Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28681", "state": "PUBLISHED", "dateUpdated": "2026-03-06T16:07:02.713Z", "dateReserved": "2026-03-02T21:43:19.927Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T04:35:59.899Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "irrd", "vendor": "irrdnet", "versions": [{"status": "affected", "version": ">= 4.4.0, < 4.4.5"}, {"status": "affected", "version": ">= 4.5.0, < 4.5.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:internet_routing_registry_daemon_project:internet_routing_registry_daemon:*:*:*:*:*:*:*:*", "matchCriteriaId": "574BCDBF-F12E-409C-B62A-5EB3A0451BD1", "versionEndExcluding": "4.4.5", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:internet_routing_registry_daemon_project:internet_routing_registry_daemon:*:*:*:*:*:*:*:*", "matchCriteriaId": "D3CAA62B-54C2-4D17-84A3-33366F007E0E", "versionEndExcluding": "4.5.1", "versionStartIncluding": "4.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the real IRRD instance to take over the account. A compromised account can then be used to modify RPSL objects maintained by the account's mntners and perform other account actions. If the user had two-factor authentication configured, which is required for users with override access, an attacker is not able to log in, even after successfully resetting the password. This issue has been patched in versions 4.4.5 and 4.5.1."}, {"lang": "es", "value": "Demonio de Internet Routing Registry versi\u00f3n 4 es un servidor de base de datos IRR, que procesa objetos IRR en formato RPSL. Desde la versi\u00f3n 4.4.0 hasta antes de la versi\u00f3n 4.4.5 y desde la versi\u00f3n 4.5.0 hasta antes de la versi\u00f3n 4.5.1, un atacante puede manipular el encabezado HTTP Host en una solicitud de restablecimiento de contrase\u00f1a o creaci\u00f3n de cuenta. El enlace de confirmaci\u00f3n en el correo electr\u00f3nico resultante puede entonces apuntar a un dominio controlado por el atacante. Abrir el enlace en el correo electr\u00f3nico es suficiente para pasar el token al atacante, quien puede entonces usarlo en la instancia real de IRRD para tomar control de la cuenta. Una cuenta comprometida puede entonces ser utilizada para modificar objetos RPSL mantenidos por los mntners de la cuenta y realizar otras acciones de la cuenta. Si el usuario ten\u00eda la autenticaci\u00f3n de dos factores configurada, lo cual es requerido para usuarios con acceso de anulaci\u00f3n, un atacante no puede iniciar sesi\u00f3n, incluso despu\u00e9s de restablecer la contrase\u00f1a con \u00e9xito. Este problema ha sido parcheado en las versiones 4.4.5 y 4.5.1."}], "id": "CVE-2026-28681", "lastModified": "2026-06-17T10:28:53.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28681", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T15:58:15.412745Z", "version": "2.0.3"}}]}, "published": "2026-03-06T05:16:37.710", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://irrd.readthedocs.io/en/stable/releases/4.4.5"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://irrd.readthedocs.io/en/stable/releases/4.5.1"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}, {"lang": "en", "value": "CWE-640"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,4.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.5.0,4.5.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "irrd", "source": "cna", "vendor": "irrdnet"}, "product": "irrd", "vendor": "irrdnet"}], "analysis": {"en": {"generated_at": "2026-04-17T12:25:14.614752+00:00", "value": {"mitigation_remediation": ["Upgrade the IRRd daemon to version 4.4.5 or later, or to 4.5.1 or later, which fix the host header validation flaw.", "If an upgrade is not yet possible, configure the web server or a WAF to reject or rewrite unexpected Host header values and enforce strict host header validation.", "Enable or enforce two\u2011factor authentication for all accounts, and review permissions so that only minimal privileges are granted to each user."], "summary": {"action": "Immediate Patch", "impact": "Account Takeover via Password Reset Poisoning"}, "threat_synthesis": {"affected_systems": "This flaw exists in the IRRd daemon from the irrdnet project, version 4 of the Internet Routing Registry database server. It affects all installations of IRRd 4.4.0 through (but not including) 4.4.5 and 4.5.0 through (but not including) 4.5.1. The issue was fixed in release 4.4.5 and again in 4.5.1, which patch the host\u2011header handling in the web UI.", "description_and_impact": "An attacker who can control the HTTP Host header during a password reset or account creation request can cause the application to send a confirmation link that points to a domain chosen by the attacker. When a user opens the link, the reset token is included in a request to the attacker\u2011controlled domain, exposing the token to the attacker. The attacker can then use the stolen token to log into the affected IRRd instance, gaining full access to the account and the ability to modify RPSL objects and perform other privileged actions. The vulnerability is mitigated for users with two\u2011factor authentication enabled for override accounts, but ordinary accounts remain vulnerable.", "risk_and_exploitability": "The vulnerability has a CVSS score of 8.1, indicating a high severity. The exploitation probability is low, with an EPSS score of less than 1%, and it is not listed in the CISA KEV catalog. Likely attack vectors involve remotely manipulating the Host header in HTTP requests sent to the web interface; based on the description, the attacker does not need privileged credentials to begin the attack. Once the reset link is poisoned, the attacker can acquire a valid authentication token and take over the account if two\u2011factor authentication is not enforced."}}}}, "created": "2026-03-06T14:55:47.681991+00:00", "updated": "2026-04-17T12:30:06.266804+00:00", "vendors": ["irrdnet", "irrdnet$PRODUCT$irrd"]}