AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable… (CVE-2026-100856)
AzuraCast versions prior to 0.23.6 contain a code injection vulnerability in the remote relay password field. This arises from incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can exploit this to inject nested Liquidsoap interpolation syntax, enabling arbitrary code execution within the Liquidsoap process, disclosure of internal API keys, or disruption of station operations.
AI Analysis
Technical Summary
The vulnerability in AzuraCast before version 0.23.6 is a code injection flaw located in the remote relay password field. It results from an incomplete migration from the vulnerable cleanUpString method to the safer toRawString method. An attacker possessing RemoteRelays station permission can inject nested Liquidsoap interpolation syntax, which allows execution of arbitrary code in the Liquidsoap process. This can lead to disclosure of sensitive internal API keys or disruption of the station's operation. The CVSS 3.1 score is 8.8, indicating a high severity with network attack vector, low attack complexity, and privileges required at the RemoteRelays station permission level.
Potential Impact
Successful exploitation allows an attacker with RemoteRelays station permission to execute arbitrary code in the Liquidsoap process, potentially leading to disclosure of internal API keys and disruption of station operations. This compromises confidentiality, integrity, and availability of the affected system components.
Mitigation Recommendations
A fix is available in AzuraCast version 0.23.6. Users should upgrade to version 0.23.6 or later to remediate this vulnerability. No other mitigation guidance is provided.
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable… (CVE-2026-100856)
Description
AzuraCast versions prior to 0.23.6 contain a code injection vulnerability in the remote relay password field. This arises from incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can exploit this to inject nested Liquidsoap interpolation syntax, enabling arbitrary code execution within the Liquidsoap process, disclosure of internal API keys, or disruption of station operations.
CVSS v3.1
Score 8.8high
Affected software
pkg:github/azuracast/AzuraCastRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in AzuraCast before version 0.23.6 is a code injection flaw located in the remote relay password field. It results from an incomplete migration from the vulnerable cleanUpString method to the safer toRawString method. An attacker possessing RemoteRelays station permission can inject nested Liquidsoap interpolation syntax, which allows execution of arbitrary code in the Liquidsoap process. This can lead to disclosure of sensitive internal API keys or disruption of the station's operation. The CVSS 3.1 score is 8.8, indicating a high severity with network attack vector, low attack complexity, and privileges required at the RemoteRelays station permission level.
Potential Impact
Successful exploitation allows an attacker with RemoteRelays station permission to execute arbitrary code in the Liquidsoap process, potentially leading to disclosure of internal API keys and disruption of station operations. This compromises confidentiality, integrity, and availability of the affected system components.
Mitigation Recommendations
A fix is available in AzuraCast version 0.23.6. Users should upgrade to version 0.23.6 or later to remediate this vulnerability. No other mitigation guidance is provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mvfp-2r94-2mw9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100856"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ab89bbdf7a7c54106941eaf
Added to database: 09/27/2026, 04:29:49 UTC
Last enriched: 09/27/2026, 04:32:17 UTC
Last updated: 09/28/2026, 01:47:40 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.