CVE-2026-26975Disclosure(music-assistant / music_assistant_server)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch music-assistant music_assistant_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installations. The music/playlists/update API allows users to bypass the .m3u extension enforcement and write files anywhere on the filesystem, which is exacerbated by the container running as root. This can be exploited to achieve Remote Code Execution by writing a malicious .pth file to the Python site-packages directory, which will execute arbitrary commands when Python loads. This issue has been fixed in version 2.7.0.

music-assistant CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/music-assistant/server/security/advisories/GHSA-7jcc-p6xr-835j

Other references

Weakness type (CWE)

CWE-22CWE-73CWE-434

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

music_assistant_server

Threat summary

Patch or workaround signal is available
8 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 7 signals
Disclosure: 4 classified signals
General: 2 classified signals
Peaked 2d ago at 6 mentions (2026-02-20); latest day: 1
8 total mentions across 3 days

Affected systems

Vendors

music-assistant

Products

music_assistant_server

Deep dive

Activity timeline8 mentions / 3d

Signal classification3 categories

Disclosure

450.0%

General

225.0%

Patch

225.0%

Referenced assets12 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-20	6	Disclosure2General2Patch2
2026-02-25	1	Disclosure1
2026-03-03	1	Disclosure1

Full discourse8 posts

TheZDIBugs@TheZDIBugs222d
Disclosure
[ZDI-26-133|CVE-2026-26975] (Pwn2Own) Music Assistant _update_library_item External Control of File Path Remote Code Execution Vulnerability (CVSS 8.8; Credit: Emanuele Barbeno, Cyrill Bannwart, Urs Mueller, Lukasz D, Yves Bieri of Compass Security) https://www.zerodayinitiative.com/advisories/ZDI-26-133/
Post summary
An advisory for CVE-2026-26975, a Remote Code Execution vulnerability in Music Assistant, was released by Zero Day Initiative with a CVSS score of 8.8.
00010545
5.4K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds233d
Disclosure
CVE-2026-26975 Unauthenticated Remote Code Execution in Music Assistant Media Li... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26975 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
A new CVE, CVE-2026-26975, is announced, noting an unauthenticated remote code execution flaw in Music Assistant Media, with links for further details but no PoC, exploit, or patch information provided.
0001042
4.0K followersView on X
CRAC Learning - Tech@cracbot228d
Disclosure
CVE-2026-26975 (CVSS:8.8, HIGH) is Awaiting Analysis. Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Vers..https://nvd.nist.gov/vuln/detail/CVE-2026-26975 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
CVE-2026-26975 is a high‑severity vulnerability in Music Assistant, currently awaiting analysis, with a CVSS score of 8.8 and a link to the NVD entry.
0000035
172 followersView on X
CVEFind.com@CveFindCom233d
Patch
[CVE-2026-26975: HIGH] Update to Music Assistant 2.7.0 now! Versions 2.6.3 and below have a security flaw allowing unauthenticated attackers to execute code. Keep your system safe from cyber threats.#cve,CVE-2026-26975,#cybersecurity https://cvefind.com/CVE-2026-26975
Post summary
The post announces a high‑severity vulnerability in Music Assistant and urges users to update to version 2.7.0.
0000040
578 followersView on X
CVE@CVEnew233d
General
CVE-2026-26975 Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated net… https://www.cve.org/CVERecord?id=CVE-2026-26975
Post summary
The text mentions CVE‑2026‑26975 affecting Music Assistant versions 2.6.3 and below with incomplete reference to unauthenticated access, but provides no detailed technical data, mitigation, or exploitation evidence.
0000073
56.4K followersView on X
OffSeq | Adversary Tactics for Cyber Resilience@offseq234d
Patch
🚨 HIGH severity: Unauthenticated RCE in Music Assistant server <2.7.0! Remote attackers can gain root via playlist update API. Patch ASAP to protect your systems. https://radar.offseq.com/threat/cve-2026-26975-cwe-73-external-control-of-file-nam-f0001b29 #OffSeq #Vulnerability... https://t.co/9Zqg8FQQNO
Post summary
The tweet announces a high‑severity unauthenticated RCE in Music Assistant server and urges users to apply a patch immediately.
0000040
265 followersView on X
CVETodo@CveTodo234d
General
**References:** - [GitHub Pull Request #2684](https://github.com/music-assistant/server/pull/2684) - [Release Notes 2.7.0](https://github.com/music-assistant/server/releases/tag/2.7.0) - [Security Advisory GHSA-7jcc-p6xr-835j](https://github.com/music-assistant/server/security/advisories/GHSA-7jcc-p6xr-835j) #Cybersecurity #CVE #HighSeverity #SecurityAlert #RemoteCodeExecution #PrivilegeEscalation https://cvetodo.com/cve/CVE-2026-26975
Post summary
The tweet announces a high‑severity vulnerability (CVE‑2026‑26975) that enables remote code execution and privilege escalation, but provides no PoC, exploit code, or patch information.
0000043
20 followersView on X
The Hacker Wire@TheHackerWire234d
Disclosure
🟠 CVE-2026-26975 - High Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers t... https://www.thehackerwire.com/vulnerability/CVE-2026-26975/ https://t.co/DP5U3vDYQH
Post summary
The tweet announces CVE-2026-26975 as a high‑severity vulnerability in Music Assistant (v<=2.6.3) that permits unauthenticated network‑adjacent attackers to exploit the system. No PoC, exploit tool, or active exploitation is referenced.
0000047
112 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	music-assistant	music_assistant_server	-	-	-

Explore more

Back to dashboard music-assistant CVEs music_assistant_server vulnerabilities

What researchers are saying

CVE-2026-26975

OffSeq | Adversary Tactics for Cyber Resilience[verified]@offseqPatch

The tweet announces a high‑severity unauthenticated RCE in Music Assistant server and urges users to apply a patch immediately.

CVETodo[verified]@CveTodoGeneral

The tweet announces a high‑severity vulnerability (CVE‑2026‑26975) that enables remote code execution and privilege escalation, but provides no PoC, exploit code, or patch information.

TheZDIBugs@TheZDIBugsDisclosure

An advisory for CVE-2026-26975, a Remote Code Execution vulnerability in Music Assistant, was released by Zero Day Initiative with a CVSS score of 8.8.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new CVE, CVE-2026-26975, is announced, noting an unauthenticated remote code execution flaw in Music Assistant Media, with links for further details but no PoC, exploit, or patch information provided.

CRAC Learning - Tech@cracbotDisclosure

CVE-2026-26975 is a high‑severity vulnerability in Music Assistant, currently awaiting analysis, with a CVSS score of 8.8 and a link to the NVD entry.

CVEFind.com@CveFindComPatch

The post announces a high‑severity vulnerability in Music Assistant and urges users to update to version 2.7.0.

CVE@CVEnewGeneral

The text mentions CVE‑2026‑26975 affecting Music Assistant versions 2.6.3 and below with incomplete reference to unauthenticated access, but provides no detailed technical data, mitigation, or exploitation evidence.

The Hacker Wire@TheHackerWireDisclosure

The tweet announces CVE-2026-26975 as a high‑severity vulnerability in Music Assistant (v<=2.6.3) that permits unauthenticated network‑adjacent attackers to exploit the system. No PoC, exploit tool, or active exploitation is referenced.