Code Injection Vulnerability in AzuraCast Software by AzuraCast
CVE-2026-100856

8.7HIGH

Key Information:

Vendor

Azuracast

Status
Azuracast
Vendor
CVE Published:
27 September 2026

What is CVE-2026-100856?

AzuraCast versions prior to 0.23.6 are susceptible to a code injection issue linked to the remote relay password field. This flaw arises from an incomplete migration process from the deprecated cleanUpString method to the toRawString function. Attackers with the necessary RemoteRelays station permission can exploit this vulnerability by injecting nested Liquidsoap interpolation syntax, enabling them to execute arbitrary code within the Liquidsoap process. Consequently, this may lead to unauthorized disclosure of internal API keys and potential disruption of service for the affected stations.

Affected Version(s)

AzuraCast 0 < 0.23.6

AzuraCast 0.23.6

References

https://github.com/AzuraCast/AzuraCast/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/azuracast-before-0.2...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

offset
.