CVE-2026-121428
Deferred Deferred - Pending Action

Authenticated RCE via Supervisor Config Injection in AzuraCast

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121428
EUVD
EUVD-2026-115960

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AzuraCast AzuraCast 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a remote code execution (RCE) vulnerability in AzuraCast through version 0.23.8. Authenticated station managers can inject malicious Supervisor configuration by entering newlines and commands in the station timezone field. When the configuration regenerates, the injected command executes with root privileges.

Detection Guidance

Check AzuraCast logs for suspicious timezone edits or Supervisor configuration changes. Inspect Supervisor configuration files for unexpected programs or commands. Look for unauthorized root-level command execution in system logs.

Impact Analysis

An attacker with station manager access could execute arbitrary OS commands as root, potentially accessing or deleting station data, disrupting broadcasting services, or gaining further control over the AzuraCast system.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, potentially violating GDPR (data protection) and HIPAA (health data privacy) requirements. Compliance may be compromised due to loss of data integrity and confidentiality.

Mitigation Strategies

Upgrade AzuraCast to the latest version beyond 0.23.8. Restrict station manager permissions to prevent unauthorized timezone edits. Review Supervisor configurations for malicious entries and remove them.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...