{"id":"CVE-2026-121428","kind":"vulnerability","aliases":["CVE-2026-121428"],"related":[],"title":"AzuraCast: timezone field lets station managers run commands as root","description":"AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.","summary":"AzuraCast, a web radio hosting panel, accepts newlines in the station timezone field, which lets a station manager inject a Supervisor program definition. When the configuration regenerates, that program runs operating system commands as root.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azuracast","other","radio","self-hosted"],"not_affected_if":["newer-version","no-station-managers"],"how_to_check":"- Check the AzuraCast version with the installed release tag; the sources say the issue affects `0.23.8` and earlier.\n- List station manager accounts and review who can edit station profiles.","fix":"- Move AzuraCast past `0.23.8`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-03T15:17:33+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","triaged_at":"2026-11-03T15:22:27+00:00","updated_at":"2026-11-03T15:22:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-03T15:22:27Z","model":"claude-haiku-5-5","output":{"fix":"- Move AzuraCast past `0.23.8`; the sources do not name the exact fixed release.","reach":"network","title":"AzuraCast: timezone field lets station managers run commands as root","impact":"high","summary":"AzuraCast, a web radio hosting panel, accepts newlines in the station timezone field, which lets a station manager inject a Supervisor program definition. When the configuration regenerates, that program runs operating system commands as root.","audience":"businesses","category":"other","nicknames":[],"who_cares":["azuracast","self-hosted","radio"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Commands run as root on the AzuraCast server","analyst_note":"Confirm the fixed AzuraCast release and whether the timezone input is validated in a later version, via the vendor advisory on github.com.","how_to_check":"- Check the AzuraCast version with the installed release tag; the sources say the issue affects `0.23.8` and earlier.\n- List station manager accounts and review who can edit station profiles.","plain_action":"","needs_analyst":true,"not_affected_if":["no-station-managers","newer-version"],"who_is_affected":"Any AzuraCast install through 0.23.8 where someone with station manager access can edit the station profile. Sites that only run admins or that have no station managers have less exposure, but the sources do not say how far that narrows it. Hosts that never ran AzuraCast can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000687,"input_tokens":4172,"output_tokens":540,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121428':13A,16A '-2026':12A,15A '0.23.8':60C 'accept':29B 'allow':68C 'api':92C 'attack':81C 'authent':69C 'azuracast':1A,17B,23B,58C 'code':64C 'command':8A,55B,101C 'configur':48B,75C,105C 'contain':61C,86C 'cve':11A,14A 'defin':93C 'definit':45B 'edit':91C 'execut':65C,99C 'field':3A,35B,80C 'host':22B,27B 'inject':41B,73C 'let':4A,37B 'manag':6A,40B,71C 'new':95C 'newlin':30B,87C 'oper':53B 'os':100C 'panel':28B 'profil':90C 'program':44B,51B,97C 'radio':19B,26B 'regener':49B,106C 'remot':63C 'root':10A,57B,103C 'run':7A,52B 'self':21B 'self-host':20B 'station':5A,33B,39B,70C,78C 'submit':83C 'supervisor':43B,74C,96C 'system':54B 'timezon':2A,34B,79C,85C 'vulner':66C 'web':25B","nicknames":[],"mitigations":[],"who_affected":"Any AzuraCast install through 0.23.8 where someone with station manager access can edit the station profile. Sites that only run admins or that have no station managers have less exposure, but the sources do not say how far that narrows it. Hosts that never ran AzuraCast can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azuracast","high","other","radio","selfhosted"],"first_public_at":"2026-10-18T16:50:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121428","severity":null,"published_at":"2026-11-03T15:17:33+00:00","modified_at":"2026-11-03T15:17:33+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","fetched_at":"2026-11-03T15:21:59+00:00","note":null}],"documents":[{"id":58381,"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-18T16:50:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58382,"url":"https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}