Live › vulnerability › CVE-2026-112305
Go to dashboardSemaphore UI through 2.19.16 lets a user with the task_runner role override protected Ansible variables by supplying arbitrary keys in the task environment JSON. An attacker can set ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to run commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| semaphore | github | <= 2.19.16 | – |
semaphore version or check the UI footer: 2.19.16 or older is affected2.19.17 and 2.20.x betas do not list a fixEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.
This page as .md · .json · in your agent: get_signal("CVE-2026-112305")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.