{"id":"CVE-2026-112305","kind":"vulnerability","aliases":["CVE-2026-112305"],"related":[],"title":"Semaphore UI: task runners can execute commands on the server","description":"Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.","summary":"Semaphore UI through 2.19.16 lets a user with the task_runner role override protected Ansible variables by supplying arbitrary keys in the task environment JSON. An attacker can set ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to run commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"semaphore","fixed":[],"affected":"<= 2.19.16","ecosystem":"github"}],"ecosystems":[],"tags":["ansible","other","self-hosted","semaphore-ui"],"not_affected_if":["auth-required","no-task-runner-users","version-above-2.19.16"],"how_to_check":"Run 'semaphore version' or check the UI footer: 2.19.16 or older is affected. List users with the task_runner role in each project (Team tab). Look in task history for environment JSON containing ansible_ssh_common_args, ansible_connection or ansible_host.","fix":"No confirmed fixed version. 2.19.17 and 2.20.x betas do not list a fix. Until one is published: limit the task_runner role to trusted users, and check the project's GitHub advisories for a patch release.","status":"open","published_at":"2026-10-19T16:17:06+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:33:10+00:00","updated_at":"2026-10-24T00:22:25+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T22:33:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Semaphore UI: task runners can execute commands on the server","impact":"high","summary":"Semaphore UI through 2.19.16 lets a user with the task_runner role override protected Ansible variables by supplying arbitrary keys in the task environment JSON. An attacker can set ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to run commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.","category":"other","who_cares":["semaphore-ui","ansible","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Commands run as the server user; encryption keys and secrets readable","analyst_note":"Confirm the fixed version and patch release in the NVD entry or the Semaphore project advisory; the sources give no fix version.","how_to_check":"Check the Semaphore UI version (through 2.19.16 is affected). Review which accounts hold the task_runner role.","needs_analyst":true,"not_affected_if":["no-task-runner-users","version-above-2.19.16"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000506,"input_tokens":2958,"output_tokens":421,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and patch release in the NVD entry or the Semaphore project advisory; the sources give no fix version.","search":"'-112305':13A,16A '-2026':12A,15A '2.19.16':29B,85C 'allow':93C 'ansibl':18B,40B,55B,63B,103C,119C,127C 'arbitrari':44B,107C 'arg':58B,122C 'attack':52B,114C 'code':89C 'command':7A,68B,132C 'common':57B,121C 'connect':64B,128C 'contain':86C 'cve':11A,14A 'encrypt':75B,139C 'environ':49B,112C 'execut':6A,90C,131C 'expos':74B,138C 'host':22B 'json':50B,113C 'key':45B,76B,78B,108C,140C,142C 'let':30B 'local':65B,129C 'overrid':38B,101C 'post':116C 'protect':39B,102C 'proxycommand':61B,125C 'remot':88C 'role':37B,99C 'run':67B 'runner':4A,36B,98C 'secret':81B,145C 'self':21B 'self-host':20B 'semaphor':1A,24B,26B,71B,82C,135C 'semaphore':17A 'semaphore-ui':23B 'server':10A,72B,136C 'set':54B,118C 'ssh':56B,77B,120C,141C 'store':80B,144C 'suppli':43B,106C 'task':3A,35B,48B,97C,111C,117C 'ui':2A,25B,27B,83C 'user':32B,73B,94C,137C 'variabl':41B,104C 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112305","severity":null,"published_at":"2026-10-19T16:17:06+00:00","modified_at":"2026-10-19T18:17:05+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112305:646","url":null,"severity":null,"published_at":"2026-10-24T00:22:25+00:00","modified_at":"2026-10-24T00:22:25+00:00","first_seen_at":"2026-10-24T00:22:25+00:00","fetched_at":"2026-10-24T00:22:25+00:00","note":"Affected <=2.19.16 (CVE.org/VulnCheck, CVSS 8.8 v3.1). No vendor advisory or fixed version found: PR #3888 (the referenced patch) is closed, not merged; release 2.19.17 notes (runner check interval) do not mention a fix. Fix unknown until maintainers publish a GHSA/changelog. No exploitation or PoC seen; no X search done."}],"documents":[{"id":2567,"url":"https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.16-rce-via-task-environment-ansible-variable-override","title":"VulnCheck: Semaphore UI through 2.19.16 RCE via task environment","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2568,"url":"https://github.com/semaphoreui/semaphore/pull/3888","title":"PR #3888 harden RBAC, block task-level var injection (closed)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2569,"url":"https://github.com/semaphoreui/semaphore/releases","title":"semaphoreui/semaphore releases","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}