TI-2026-51419 CVE-2026-73294 · GHSA-xp7j-h7jc-4w8p
Semaphore U: OS Command Injection
Priority HIGH 76
Semaphore UI is a web interface for managing DevOps tools.
semaphoreui
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
semaphoreui records in CISA KEVNo semaphoreui vulnerabilities are listed in CISA KEV.
Records
5 records
TI-2026-51418 CVE-2026-73293 · GHSA-cxvf-gvfq-36w2
Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
Priority HIGH 73
Semaphore UI is a web interface for managing DevOps tools.
TI-2026-62124 CVE-2026-91994 · GHSA-rvf3-c57p-p58j
Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests
Priority MEDIUM 64
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware.
TI-2026-76499 CVE-2026-112305 · GHSA-6cr7-7xqc-c37c
Remote code execution in Semaphore UI via Ansible variable override
Priority MEDIUM 40
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON.
TI-2026-51417 CVE-2026-73292 · GHSA-8cj9-r88m-8945
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
Priority LOW 38
Semaphore UI is a web interface for managing DevOps tools.