CVE-2026-100852 AzuraCast CVE debrief

Who should care

Defenders responsible for AzuraCast installations, particularly those with authenticated station users with Streamers and Profile permissions, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-100852 is a command injection vulnerability in AzuraCast before 0.23.8 that allows authenticated station users to execute commands as the Liquidsoap process user. Defenders should prioritize verification, remediation, and monitoring to prevent potential command execution and lateral movement.

• Command execution as the Liquidsoap process user when recording closes
• Potential for lateral movement or escalation of privileges
• Need for verification of affected versions and remediation priority
• Potential for data tampering or unauthorized access

Technical summary

The vulnerability is caused by a failure to quote the streamer username in process.run calls in the Liquidsoap config generation for live recording. This allows authenticated station users with Streamers and Profile permissions to set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes. The vulnerability can be exploited by setting a username with shell metacharacters, leading to command execution. Defenders should prioritize verifying and upgrading to a fixed version of AzuraCast, restricting access to authenticated station users with Streamers and Profile permissions, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and upgrading to a fixed version of AzuraCast, restricting access to authenticated station users with Streamers and Profile permissions, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and upgrade to a fixed version of AzuraCast
• Restrict access to authenticated station users with Streamers and Profile permissions
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a failure to quote the streamer username in process.run calls in the Liquidsoap config generation for live recording. This allows authenticated station users with Streamers and Profile permissions to set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.