CVE-2026-121429

Summary

AzuraCast through 0.23.8 allows station users with Profile permission to inject and execute arbitrary OS commands via StereoTool settings (stereo_tool_configuration_path or stereo_tool_license_key) during station restart, as the values are passed unescaped to /bin/sh, leading to container compromise.

Exploitability

Exploitation requires valid station user credentials with Profile permission and knowledge of which fields accept user-controlled input; no special privileges beyond that are needed.

Blast radius

Successful exploitation grants full OS-level access inside the AzuraCast container, enabling data theft, lateral movement, or service disruption across the host and potentially other containers sharing resources.

Detection

Defenders should monitor for unexpected /bin/sh invocations during station restart events in container logs, especially those triggered by non-root users with Profile permissions, and inspect logs for abnormal process spawning patterns from the web application context.

Prioritized remediation

Upgrade to AzuraCast version 0.23.9 or later, which patches the command injection in StereoTool configuration handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.