# CVE-2026-121428: AzuraCast code injection in timezone field

Source: https://junglewise.ai/threats/cve-2026-121428-azuracast-through-0-23-8-contains-a-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121428 · Severity: high · CVSS 8.8 · Published 2026-11-03

AzuraCast is a web-based radio station management and streaming platform. An authenticated station manager can inject malicious Supervisor configuration through the timezone field, allowing arbitrary command execution with root privileges on the server. This gives attackers access to sensitive application data, the ability to disrupt broadcasting services, and potential for lateral movement.

Technologies: [AzuraCast](https://junglewise.ai/threats/technologies/azuracast). Vendors: [AzuraCast](https://junglewise.ai/threats/vendors/azuracast).

## Quick answers

**Is CVE-2026-121428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121428 being exploited in the wild.

**How severe is CVE-2026-121428?** High severity, with a CVSS score of 8.8, published 3 November 2026.

**Which products and versions are affected?** AzuraCast through 0.23.8.

**Is there a fix for CVE-2026-121428?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-121428 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-121428?** Check whether you run AzuraCast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw in the Radio\Configuration::buildEnvironment() function, which writes the station timezone field into Supervisor configuration without proper escaping. An authenticated attacker with station profile edit permissions can insert newlines and Supervisor configuration syntax to define a new program section that executes arbitrary OS commands as root when the station configuration is regenerated. Network access and authentication as a station manager are required.

## Affected products

- AzuraCast AzuraCast through 0.23.8

## Timeline

- 2026-10-18: disclosed
- 2026-11-03: advisory

## References

- [https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2](https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2)
- [https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone](https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone)

## Related threats

- [AzuraCast server-side request forgery via webhook redirects](https://junglewise.ai/threats/cve-2026-124442-azuracast-before-0-24-0-contains-a-server-side-request-forgery)
- [AzuraCast CSV formula injection in bulk media import](https://junglewise.ai/threats/cve-2026-121433-azuracast-before-0-24-0-contains-a-stored-csv-formula-injection)
- [AzuraCast webhook connectors server-side request forgery filter bypass](https://junglewise.ai/threats/cve-2026-121431-azuracast-before-0-24-0-contains-a-server-side-request-forgery)
- [AzuraCast missing authorization in waveform endpoints](https://junglewise.ai/threats/cve-2026-121430-azuracast-before-0-24-0-contains-a-missing-authorization)
- [AzuraCast command injection in StereoTool configuration](https://junglewise.ai/threats/cve-2026-121429-azuracast-through-0-23-8-contains-a-command-injection)