TI-2026-76499 Aliases CVE-2026-112305 GHSA-6cr7-7xqc-c37c

Remote code execution in Semaphore UI via Ansible variable override

MEDIUM 40CWE-915Published 2026-10-19 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-915.

Summary

Semaphore UI through 2.19.16 lets users with the task_runner role override protected Ansible variables by supplying arbitrary keys in the task environment JSON, a flaw classified as CWE-915. An authenticated user with the task_runner role can execute commands as the Semaphore server user. Successful exploitation exposes encryption keys, SSH keys and stored secrets.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00563 47th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
semaphoreui	Semaphore UI	up to 2.19.16	—	No fix listed	CNA

Semaphore UI Vendorsemaphoreui Affected up to 2.19.16 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Semaphore UI.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-19 Threatist record created from CVE-2026-112305
2026-10-19 CISA SSVC decision points changed
2026-10-19 Priority changed: MEDIUM → LOW
2026-10-20 Alias added: GHSA-6cr7-7xqc-c37c
2026-10-21 Priority changed: LOW → MEDIUM

References

Patch 1

https://github.com/semaphoreui/semaphore/pull/3888

Other 3

TI-2026-51419 Semaphore U: OS Command Injection CVSS 3.1CRITICAL 9.9
TI-2026-51418 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision CVSS 3.1HIGH 8.8
TI-2026-62124 Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests CVSS 4.0HIGH 7.1
TI-2026-51417 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation CVSS 3.1HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences