Live › vulnerability › CVE-2026-121428
AzuraCast, a web radio hosting panel, accepts newlines in the station timezone field, which lets a station manager inject a Supervisor program definition. When the configuration regenerates, that program runs operating system commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Any AzuraCast install through 0.23.8 where someone with station manager access can edit the station profile. Sites that only run admins or that have no station managers have less exposure, but the sources do not say how far that narrows it. Hosts that never ran AzuraCast can skip it.
No product ranges from the sources yet.
0.23.8 and earlier.0.23.8; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.
This page as .md · .json · in your agent: get_signal("CVE-2026-121428")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.