CVE-2026-121428 in AzuraCast
Summary
by MITRE • 11/03/2026
AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The AzuraCast platform, specifically versions up to 0.23.8, suffers from a critical remote code execution vulnerability rooted in insufficient input validation within its station management interface. This flaw allows authenticated users with the role of station manager to execute arbitrary operating system commands on the underlying server infrastructure. The attack vector is facilitated through the profile edit API endpoint, which handles configuration updates for individual radio stations. While authentication provides an initial layer of access control, it does not adequately sanitize or validate specific input fields that are subsequently processed by backend services responsible for generating runtime configurations.
The technical core of this vulnerability lies in how the system processes the timezone field during station profile modifications. The application accepts user-supplied values for the timezone setting and incorporates them into Supervisor configuration files without proper escaping or restriction to valid timezone identifiers. By injecting newline characters into this field, an attacker can break out of the intended single-line value context and inject arbitrary lines into the Supervisor program definition section. This technique exploits a classic injection flaw where structured data formats are manipulated by introducing control characters that alter the parsing logic of the configuration file generator.
Once the malicious content is injected via the API request, it remains dormant until the system triggers a regeneration of its service configurations. During this regeneration phase, the Supervisor daemon reads the modified configuration files and interprets the injected lines as valid program definitions. Consequently, any command specified within these injected entries is executed with root privileges by the Supervisor process. This escalation to root-level execution represents a severe compromise of system integrity, granting the attacker full control over the host operating system rather than just limited access to the application layer.
From an operational impact perspective, this vulnerability enables complete server takeover for any AzuraCast instance where station managers have been granted API access and are permitted to edit their own profiles. An adversary can leverage this capability to install backdoors, exfiltrate sensitive data such as listener logs or payment information, pivot into internal network segments, or disrupt service availability by terminating critical processes. The ability to execute commands as root significantly amplifies the risk profile, allowing for persistent access and deep system modification that is difficult to detect without comprehensive monitoring of configuration file changes and process executions.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) under the category of injection flaws where user input directly influences code execution logic. In terms of threat modeling, it maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically involving system-level command execution via configuration manipulation. The attack path also reflects aspects of CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), although the specific mechanism relies on configuration file injection rather than direct shell invocation by the application code itself.
Mitigation strategies should prioritize immediate patching to version 0.23.9 or later, where input validation for the timezone field has been strengthened to reject non-standard characters and enforce strict adherence to valid IANA timezone database entries. In environments where upgrading is not immediately feasible, administrators can implement a web application firewall rule to block requests containing newline characters within the station profile edit API parameters. Additionally, restricting API access to trusted IP ranges and enforcing multi-factor authentication for all administrative accounts reduces the attack surface available to potential exploiters. Regular auditing of Supervisor configuration files and monitoring for unexpected process spawns by root users can also aid in early detection of such exploitation attempts.