Remote Code Execution in AzuraCast via Liquidsoap Injection

Executive Summary

CVE-2026-100856 is a code injection vulnerability in AzuraCast versions 0.23.5 and earlier. It occurs because the remote relay password field still uses an old vulnerable method called cleanUpString() which fails to fully block Liquidsoap interpolation patterns. Attackers with RemoteRelays station permission can bypass this by injecting nested interpolation syntax like #{#{EXPR}} to execute arbitrary code in the Liquidsoap process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your AzuraCast instance is running version 0.23.5 or earlier. Inspect the remote relay password field configuration for Liquidsoap interpolation patterns like #{...} or nested syntax such as #{#{EXPR}}. Review Liquidsoap process logs for unexpected commands or API key disclosures.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary code in the Liquidsoap process. Potential impacts include disclosure of internal API keys, remote code execution (e.g., running system commands like 'id'), and file read/write operations within the Liquidsoap container. Attackers only need minimal privileges (RemoteRelays permission) and no user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as internal API keys or system files, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Unauthorized code execution could also result in data breaches or integrity violations, further compromising compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade AzuraCast to version 0.23.6 or later immediately. Ensure the remote relay password field uses the toRawString method instead of cleanUpString. Remove or deprecate the cleanUpString method entirely. Restrict RemoteRelays station permissions to trusted users only.

Useful 0 Not Useful 0