Is CVE-2026-121431 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121431 being exploited in the wild.

How severe is CVE-2026-121431?

Medium severity, with a CVSS score of 5.3, published 3 November 2026.

How is CVE-2026-121431 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-121431?

Check whether you run AzuraCast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121431: AzuraCast webhook connectors server-side request forgery filter bypass

CVE-2026-121431 · Severity: medium · CVSS 5.3 · Published 2026-11-03

AzuraCast is a web-based radio station management platform that allows stations to send notifications via webhooks to external services like Mastodon and Telegram. A security flaw in version 0.24.0 and earlier allows station users with webhook configuration permissions to bypass safety filters and make the server send requests to internal systems like cloud metadata services or private databases. An attacker could exploit this to extract sensitive configuration data or compromise internal infrastructure.

Technologies: AzuraCast. Vendors: AzuraCast.

Quick answers

Is CVE-2026-121431 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121431 being exploited in the wild.
How severe is CVE-2026-121431?: Medium severity, with a CVSS score of 5.3, published 3 November 2026.
Which products and versions are affected?: AzuraCast before 0.24.0.
Is there a fix for CVE-2026-121431?: Yes: fixed in 0.24.0. Until then: Restrict the WebHooks permission to trusted users only until upgrading. Alternatively, disable webhook connectors (Mastodon, Telegram, GroupMe, RadioReg) that are not in active use. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121431 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-121431?: Check whether you run AzuraCast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.24.0

Restrict the WebHooks permission to trusted users only until upgrading. Alternatively, disable webhook connectors (Mastodon, Telegram, GroupMe, RadioReg) that are not in active use.

Technical details

A server-side request forgery (SSRF) vulnerability exists in the Mastodon, Telegram, GroupMe, and RadioReg webhook connectors. These connectors accept user-supplied URLs (instance_url, api, webhookurl) and dispatch HTTP requests without passing them through the UserUrlFilter::filterSensitiveUserUrl() safety check, unlike other connectors. An authenticated attacker with the station-scoped WebHooks permission can trigger the test webhook endpoint to reach loopback, private-network, or cloud-metadata services such as 169.254.169.254.

Affected products

AzuraCast AzuraCast before 0.24.0

Timeline

2026-10-18: disclosed
2026-11-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.