Open Redirect in irrd (CVE-2026-28681)
Summary
Vulnerability in irrd (CVE-2026-28681). Confidential information can be exposed externally. Exploitable via Host header. Mitigation: upgrade to 4.5.1 or later.
Original description
The description as published by the source.
Impact
An attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the real IRRD instance to take over the account. A compromised account can then be used to modify RPSL objects maintained by the account's mntners and perform other account actions.
If the user had two-factor authentication configured, which is required for users with override access, an attacker is not able to log in, even after successfully resetting the password.
This issue affects IRRD 4.5.0 and all 4.4.x versions prior to 4.4.5. IRRD 4.3 and earlier are not affected, as they did not include the web UI.
Cause
Email links in account creation, password reset, and mntner migration emails were generated from the HTTP request context, allowing an attacker to manipulate the HTTP Host header to redirect these links to an attacker-controlled domain (password reset poisoning).
Resolution
Requests with a Host header that does not match server.http.url are now rejected, preventing Host header injection attacks against the web UI.
All existing password reset tokens are invalidated by this upgrade, rendering any tokens that may have been captured by an attacker unusable.
Patched versions: 4.4.5 and 4.5.1.
Workarounds
Configuring a reverse proxy (such as nginx)…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-28681 has been found in irrd.
Attackers can target a specific entry point like Host header over the network to misuse the product.
Confidential information can be exposed externally.
What to do: upgrade irrd to 4.5.1 or later.
If unsure, ask your IT team or search "irrd CVE-2026-28681" on the vendor's site.
CVE-2026-28681 (irrd) — CWE-601
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: Host header / Host / server.http.url
Patched: 4.5.1 — apply immediately
Workaround: Configuring a reverse proxy (such as nginx) to reject requests where the Host header does not match the expected hostname is an effective workaround.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-601) exists in irrd. Attackers reach the vulnerable code path via Host header without authentication.
Check the vendor advisory for the affected versions of irrd. Attack surface: Host header / Host / server.http.url.
Severity: ?. Confidential information can be exposed externally.
Update to 4.5.1.
Workaround: Configuring a reverse proxy (such as nginx) to reject requests where the Host header does not match the expected hostname is an effective workaround.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'irrd' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'irrd' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
irrdを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
Configuring a reverse proxy (such as nginx) to reject requests where the `Host` header does not match the expected hostname is an effective workaround.パッチが適用されるまでの応急処置として、Configuring a reverse proxy (such as nginx) to reject requests where the
Hostheader does not match the expected hostname is an effective workaround. を実施。回避策の副作用 (機能低下) を確認した上で。 -
3Apply patch patch
Upgrade irrd to 4.5.1ステージング環境で 4.5.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web irrd.readthedocs.io
- web irrd.readthedocs.io