CVE-2026-112305
Deferred Deferred - Pending Action

Remote Code Execution in Semaphore UI

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112305
EUVD
EUVD-2026-104397

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
semaphoreui Semaphore UI 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Semaphore UI through 2.19.16 has a remote code execution flaw. Users with the task_runner role can override protected Ansible variables by sending arbitrary keys in the task environment JSON. Attackers can exploit this by POSTing tasks with ansible_ssh_common_args set to ProxyCommand or ansible_connection=local to run commands as the Semaphore server user. This exposes encryption keys, SSH keys, and stored secrets.

Detection Guidance

Check Semaphore UI logs for POST requests to /api/tasks with task environment JSON containing ansible_ssh_common_args or ansible_connection=local. Monitor for unauthorized task execution by users with the task_runner role.

Impact Analysis

An attacker could gain full control over the Semaphore server, stealing sensitive data like encryption keys, SSH keys, and secrets. This could lead to unauthorized access to systems, data breaches, or further network compromise. The impact depends on the server's permissions and stored data.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face fines, legal penalties, and reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Upgrade Semaphore UI to a version beyond 2.19.16. Restrict task_runner role permissions to prevent variable overrides. Disable or audit existing tasks using ansible_ssh_common_args or ansible_connection=local.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112305. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart