8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28681

CVE-2026-28681: IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links

Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the real IRRD instance to take over the account. A compromised account can then be used to modify RPSL objects maintained by the account's mntners and perform other account actions. If the user had two-factor authentication configured, which is required for users with override access, an attacker is not able to log in, even after successfully resetting the password. This issue has been patched in versions 4.4.5 and 4.5.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28681

CVE-2026-28681:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
irrd	pip	>= 4.4.0, < 4.4.5	4.4.5
irrd	pip	>= 4.5.0, < 4.5.1	4.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic host header injection attack. The IRRd web UI was generating links for critical actions like password resets and account creation using the HTTP Host header provided by the client without proper validation. An attacker could provide a malicious Host header pointing to a domain they control. When a legitimate user requested a password reset, the confirmation link sent to their email would point to the attacker's domain. If the user clicked this link, the password reset token would be exposed to the attacker, allowing them to take over the user's account.

The analysis of the patches confirms this. The primary fix is in irrd/server/http/app.py, where the set_middleware function is modified to add starlette.middleware.trustedhost.TrustedHostMiddleware. This middleware ensures that all incoming requests have a Host header that matches the configured server.http.url, effectively blocking the injection attack.

Furthermore, a change in irrd/webui/auth/users.py within the PasswordResetToken._hash method confirms that the password reset functionality was an attack vector. The patch modifies the secret used to generate tokens, a necessary step to invalidate all existing tokens that could have been compromised before the fix was applied. The functions identified are either directly responsible for the missing security control (set_middleware) or are part of the functionality that was exploited (PasswordResetToken._hash).

Vulnerable functions

irrd.server.http.app.set_middleware

irrd/server/http/app.py

This function is responsible for setting up the application's middleware stack. The vulnerability existed because this function did not configure a middleware to validate the HTTP Host header. The patch adds the `TrustedHostMiddleware` to this function, which rejects requests with untrusted Host headers, thus fixing the vulnerability at the application level.

irrd.webui.auth.users.PasswordResetToken._hash

irrd/webui/auth/users.py

This function generates the hash for password reset tokens. It was modified to use a new secret, effectively invalidating all previously issued password reset tokens. This change was a mitigation step to prevent the use of any tokens that might have been compromised through the host header injection attack, indicating that the password reset process was a primary target of this vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.