A critical host header manipulation vulnerability in IRRD version 4 allows unauthenticated attackers to hijack user accounts via malicious email links.

This vulnerability involves host header injection during password reset or account creation requests, leading to an open redirect that crafts deceptive confirmation emails. An unauthenticated attacker can capture the reset token by tricking a user into clicking a link, which subsequently grants the attacker full control over the target account.

Successful exploitation allows unauthorized access to IRRD accounts, enabling attackers to modify sensitive routing policy objects (RPSL). Given the critical role of IRR databases in global internet routing, this unauthorized modification poses a high risk of operational disruption and BGP hijacking. The CVSS score of 8.1 reflects the high impact on confidentiality and integrity, despite the requirement for user interaction.

Immediate Action: Update the IRRD software to version 4.4.5 or 4.5.1 immediately to resolve the vulnerability.

Proactive Monitoring: Review web server and application logs for suspicious HTTP Host header values in password reset or account creation requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to validate and sanitize the Host header on incoming HTTP requests to prevent header injection.

Public Exploit Available: Unknown

The risk posed by CVE-2026-28681 is severe due to the potential for unauthorized modification of critical network routing data. Administrators must prioritize the application of the official patches to versions 4.4.5 or 4.5.1 to eliminate this vector for account takeover.