« Volver al listado

CVE-2026-28681

Estado: AnalizadaAlta (8.1)—

Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the real IRRD instance to take over the account.

Leer descripción completaMostrar menos

A compromised account can then be used to modify RPSL objects maintained by the account's mntners and perform other account actions. If the user had two-factor authentication configured, which is required for users with override access, an attacker is not able to log in, even after successfully resetting the password. This issue has been patched in versions 4.4.5 and 4.5.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de manipulación de Host header en enlace de reseteo de contraseña que requiere que el usuario abra el enlace malicioso (UI:R). El impacto primario es takeover de cuenta (T1078.001) mediante token interceptado; los secundarios son modificación de objetos RPSL (T1565.003) y potencial re

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Multi-factor AuthenticationUser TrainingRestrict File and Directory PermissionsPrivileged Process IntegrityPrivileged Account ManagementPassword Policies

Tecnologías afectadas (1)

Internet Routing Registry Daemon Project — Internet Routing Registry Daemon

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-28681",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28681",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-06T15:58:15.412745Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "irrdnet",
          "product": "irrd",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.4.0, < 4.4.5"
            },
            {
              "status": "affected",
              "version": ">= 4.5.0, < 4.5.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-06T05:16:37.710",
  "references": [
    {
      "url": "https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://irrd.readthedocs.io/en/stable/releases/4.4.5",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://irrd.readthedocs.io/en/stable/releases/4.5.1",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        },
        {
          "lang": "en",
          "value": "CWE-640"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the real IRRD instance to take over the account. A compromised account can then be used to modify RPSL objects maintained by the account's mntners and perform other account actions. If the user had two-factor authentication configured, which is required for users with override access, an attacker is not able to log in, even after successfully resetting the password. This issue has been patched in versions 4.4.5 and 4.5.1."
    },
    {
      "lang": "es",
      "value": "Demonio de Internet Routing Registry versión 4 es un servidor de base de datos IRR, que procesa objetos IRR en formato RPSL. Desde la versión 4.4.0 hasta antes de la versión 4.4.5 y desde la versión 4.5.0 hasta antes de la versión 4.5.1, un atacante puede manipular el encabezado HTTP Host en una solicitud de restablecimiento de contraseña o creación de cuenta. El enlace de confirmación en el correo electrónico resultante puede entonces apuntar a un dominio controlado por el atacante. Abrir el enlace en el correo electrónico es suficiente para pasar el token al atacante, quien puede entonces usarlo en la instancia real de IRRD para tomar control de la cuenta. Una cuenta comprometida puede entonces ser utilizada para modificar objetos RPSL mantenidos por los mntners de la cuenta y realizar otras acciones de la cuenta. Si el usuario tenía la autenticación de dos factores configurada, lo cual es requerido para usuarios con acceso de anulación, un atacante no puede iniciar sesión, incluso después de restablecer la contraseña con éxito. Este problema ha sido parcheado en las versiones 4.4.5 y 4.5.1."
    }
  ],
  "lastModified": "2026-06-17T10:28:53.900",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:internet_routing_registry_daemon_project:internet_routing_registry_daemon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "574BCDBF-F12E-409C-B62A-5EB3A0451BD1",
              "versionEndExcluding": "4.4.5",
              "versionStartIncluding": "4.4.0"
            },
            {
              "criteria": "cpe:2.3:a:internet_routing_registry_daemon_project:internet_routing_registry_daemon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3CAA62B-54C2-4D17-84A3-33366F007E0E",
              "versionEndExcluding": "4.5.1",
              "versionStartIncluding": "4.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}