CVE-2026-121428

Summary

Authenticated station managers in AzuraCast through 0.23.8 can inject malicious Supervisor configuration via the station timezone field by including newlines, enabling remote code execution as root when the configuration regenerates.

Exploitability

Exploitation requires valid station manager credentials and is straightforward due to lack of input sanitization on a single API endpoint.

Blast radius

Successful exploitation grants full root-level compromise of the host, enabling data theft, service disruption, or lateral movement within infrastructure relying on AzuraCast.

Detection

Monitor API logs for requests to the station profile edit endpoint containing newline characters in the timezone parameter; such entries may indicate attempted configuration injection.

Prioritized remediation

Upgrade to AzuraCast version 0.23.9 or later, which patches the timezone input validation flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.