Remote Code Execution Vulnerability in Semaphore UI by Semaphore

CVE-2026-112305

What is CVE-2026-112305?

Semaphore UI up to version 2.19.16 contains a vulnerability that permits users with the task_runner role to manipulate protected Ansible variables. By supplying arbitrary keys in the task environment JSON, an attacker can execute commands as the Semaphore server user. This exploitation can expose sensitive data such as encryption keys, SSH keys, and stored secrets when malicious tasks are posted. The vulnerability underscores the importance of securing user roles and validating inputs in task handling.

References