CVE-2026-100856 AzuraCast before 0.23.6 Code Injection via Remote Relay Password
Attackers with station permissions can inject code via relay passwords to execute arbitrary commands and leak API keys in AzuraCast.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100856?
CVE-2026-100856 is a high-severity code injection vulnerability in AzuraCast, published on 27 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.
Weakness: CWE-94
Which versions are affected by CVE-2026-100856?
2 open source packages ship an affected version, including azuracast/azuracast.
| Package | Affected | Fixed in |
|---|---|---|
azuracast/azuracast Packagist | All versions | 0.23.6 |
azuracast/azuracast Packagist | All versions | 0.23.6 |
How do I fix CVE-2026-100856?
Upgrade azuracast/azuracast to 0.23.6 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-100856 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100856 exists.
Sources
Also known as GHSA-mvfp-2r94-2mw9, GHSA-q4ph-8x8g-95f8.