CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL
An attacker with RemoteRelays permission can trigger SSRF against internal resources by setting a malicious relay URL, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100848?
CVE-2026-100848 is a high-severity server-side request forgery vulnerability in AzuraCast, published on 27 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri) and performs no host or IP address restriction. A user holding only the station-scoped RemoteRelays permission can therefore set a Remote Relay URL pointing at loopback, private-network, or cloud-metadata addresses (e.g. http://127.0.0.1:<port>/ or http://169.254.169.254/latest/meta-data/), and AzuraCast's periodic background Now Playing sync (AbstractRemote::getNowPlayingAsync) will automatically and repeatedly issue HTTP requests to that address, resulting in server-side request forgery against internal resources. This affects the main branch as of commit bcf8754eef3a268ad82c3db4d81f7920c3c28b56 (2026-07-31); no patched version is available at the time of the advisory.
Weakness: CWE-918
Which versions are affected by CVE-2026-100848?
How do I fix CVE-2026-100848?
No fix has been published for CVE-2026-100848 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-100848 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100848 exists.
Sources
Also known as GHSA-4h6m-rrxm-7w3m, GHSA-xrr6-hwgm-2r77.