{"action":"Upgrade irrd to 4.4.5 or later.","affected":[{"fixed":"4.4.5","introduced":"4.4.0"},{"fixed":"4.5.1","introduced":"4.5.0"}],"component":"irrd","cve_ids":["CVE-2026-28681"],"ecosystem":"PyPI","epss":0.00487,"exploited":false,"fixed_versions":["4.4.5","4.5.1"],"ghsa_id":"GHSA-22m3-c7vp-49fj","id":"tcs_01M5KERGWRPZW52N7BXEJKTEZX","modified_at":"2026-07-13T07:26:40.433375903Z","published_at":"2026-03-04T20:33:21Z","references":["https://osv.dev/vulnerability/GHSA-22m3-c7vp-49fj","https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj","https://nvd.nist.gov/vuln/detail/CVE-2026-28681","https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb","https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c","https://github.com/irrdnet/irrd","https://irrd.readthedocs.io/en/stable/releases/4.4.5","https://irrd.readthedocs.io/en/stable/releases/4.5.1"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-22m3-c7vp-49fj","url":"https://osv.dev/vulnerability/GHSA-22m3-c7vp-49fj"}],"summary":"IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links"}