CVE-2026-100856 in AzuraCast
Summary
by MITRE • 09/27/2026
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in AzuraCast versions prior to 0.23.6 represents a critical server-side code injection flaw rooted in improper input sanitization within the remote relay configuration subsystem. This issue stems from an incomplete migration of string handling methods where the legacy cleanUpString function, which was designed to sanitize and escape potentially dangerous characters, was not fully replaced by the more robust toRawString method across all relevant code paths. Specifically, this deficiency affects the password field used for authenticating remote relay connections. Because the sanitization logic fails to adequately neutralize special characters or control sequences within user-supplied input, an attacker possessing RemoteRelays station permissions can manipulate how these inputs are processed by the underlying Liquidsoap audio streaming engine.
The technical mechanism of exploitation relies on injecting nested Liquidsoap interpolation syntax into the password field. Liquidsoap is a powerful media server application written in OCaml that AzuraCast utilizes for its radio automation and broadcasting capabilities. It supports dynamic string interpolation, allowing variables to be embedded within configuration strings at runtime. By crafting a malicious payload containing specific escape sequences or variable references, an attacker can bypass the intended scope of the password field. Instead of being treated as static authentication credentials, these injected syntax elements are interpreted by Liquidsoap during its initialization and connection phase. This allows the execution of arbitrary commands within the context of the Liquidsoap process, effectively granting the attacker a foothold on the server hosting the AzuraCast instance.
The operational impact of this vulnerability is severe due to the high privileges typically held by the application processes running media servers. Successful exploitation enables an adversary to execute arbitrary code with the same permissions as the web service or system user running Liquidsoap. This can lead to full compromise of the underlying operating system, depending on the deployment configuration and privilege separation measures in place. Beyond direct command execution, attackers can leverage this access to disclose sensitive internal API keys stored within the application's memory or configuration files. Such data leakage facilitates further lateral movement across integrated services or external platforms managed by AzuraCast. Additionally, malicious actors may disrupt station operations by injecting commands that crash the Liquidsoap process or alter streaming parameters, resulting in denial of service for listeners and administrative disruption for station owners.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically involving server-side script injection through inadequate input validation. The exploitation technique also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, where attackers use built-in system utilities or application-specific interpreters like Liquidsoap to execute unauthorized actions without deploying external malware binaries. This highlights the risk of trusting complex scripting engines with user-controlled data even when that data is ostensibly restricted by role-based access controls such as RemoteRelays permissions.
Mitigation for this vulnerability requires immediate upgrading AzuraCast to version 0.23.6 or later, where the migration from cleanUpString to toRawString has been completed and input sanitization logic has been hardened against interpolation attacks. In environments where patching is not immediately feasible, administrators should enforce strict role-based access control policies to ensure that only trusted users have RemoteRelays station permissions. Furthermore, implementing network-level restrictions such as firewall rules limiting remote relay connections to known IP addresses can reduce the attack surface. Regular security audits of application code for similar incomplete migrations or unsafe string handling practices are recommended to prevent recurrence of analogous injection flaws in other modules of the platform.