CVE-2026-28681: IRRd Password Reset Poisoning via Host Header Injection

Background

IRRd is an open-source software package that facilitates the management of Internet Routing Registries. It provides a web UI for users to create and manage their accounts, including functionalities for password resets and account creation. However, certain versions of IRRd are vulnerable to a Host header injection attack, which can lead to serious security issues.

Vulnerability Detail

The vulnerability arises from the way IRRd generates email links for password resets and account creation. An attacker can manipulate the HTTP Host header in these requests, allowing them to craft a confirmation link that points to a malicious domain. If a user clicks on this link, the attacker can capture the password reset token and use it to take over the user's account. This can lead to unauthorized modifications of RPSL objects and other account actions. Although two-factor authentication can mitigate the risk of account takeover, it does not prevent the initial exploitation of the vulnerability.

pip install --upgrade "irrd==4.5.4"

Workaround

As a temporary workaround, configure a reverse proxy (such as nginx) to reject requests where the Host header does not match the expected hostname. Here is an example nginx configuration snippet:

server {
    listen 80;
    server_name your_expected_hostname;

    location / {
        if ($host != 'your_expected_hostname') {
            return 444;
        }
        proxy_pass http://your_backend;
    }
}

Additionally, enabling two-factor authentication for all users is strongly recommended to prevent account takeover even if a password reset token is compromised.

Conclusion

The IRRd vulnerability CVE-2026-28681 poses a significant risk through Host header injection, allowing attackers to hijack password reset processes. Users are encouraged to update to the patched versions and implement recommended workarounds to secure their accounts.

See every vulnerability recorded for irrd →

FAQ