High severity · published Sep 27, 2026
CVE-2026-100856
AzuraCast before 0.23.6 Code Injection via Remote Relay Password
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AZ
AzuraCast · AzuraCast
before 0.23.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100856
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100856
vendor-advisory
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q4ph-8x8g-95f8
third-party-advisory
https://www.vulncheck.com/advisories/azuracast-before-0.23.6-code-injection-via-remote-relay-password
More from AzuraCast
9.8
CVE-2023-2531
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3
8.8
CVE-2026-100852
AzuraCast before 0.23.8 Command Injection via Streamer Username
8.8
CVE-2026-76836
AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass
8.8
CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload
8.8
CVE-2026-42606
AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass