{"id":"CVE-2026-121428","published":"2026-11-03T15:17:33.570","lastModified":"2026-11-03T19:18:02.950","description":"AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2","tags":[]},{"url":"https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone","tags":[]}],"exploitRefs":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2","tags":[]}],"hasPoc":true,"ai":{"summary":"Authenticated station managers in AzuraCast through 0.23.8 can inject malicious Supervisor configuration via the station timezone field by including newlines, enabling remote code execution as root when the configuration regenerates.","exploitability":"Exploitation requires valid station manager credentials and is straightforward due to lack of input sanitization on a single API endpoint.","blast_radius":"Successful exploitation grants full root-level compromise of the host, enabling data theft, service disruption, or lateral movement within infrastructure relying on AzuraCast.","remediation":"Upgrade to AzuraCast version 0.23.9 or later, which patches the timezone input validation flaw.","detection":"Monitor API logs for requests to the station profile edit endpoint containing newline characters in the timezone parameter; such entries may indicate attempted configuration injection.","tags":["rce","supervisor-injection","web-api","auth-bypass","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:57:12.442Z"}}