---
id: "CVE-2026-112305"
kind: "vulnerability"
aliases: ["CVE-2026-112305"]
title: "Semaphore UI: task runners can execute commands on the server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "semaphore", "fixed": [], "affected": "<= 2.19.16", "ecosystem": "github"}]
ecosystems: []
tags: ["ansible", "other", "self-hosted", "semaphore-ui"]
not_affected_if: ["auth-required", "no-task-runner-users", "version-above-2.19.16"]
published_at: "2026-10-19T16:17:06+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-24T00:22:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112305", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:22:25+00:00"}]
---

# Semaphore UI: task runners can execute commands on the server

Semaphore UI through 2.19.16 lets a user with the task_runner role override protected Ansible variables by supplying arbitrary keys in the task environment JSON. An attacker can set ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to run commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:semaphore affected <= 2.19.16 fixed ?

## How to check

Run 'semaphore version' or check the UI footer: 2.19.16 or older is affected. List users with the task_runner role in each project (Team tab). Look in task history for environment JSON containing ansible_ssh_common_args, ansible_connection or ansible_host.

## Fix

No confirmed fixed version. 2.19.17 and 2.20.x betas do not list a fix. Until one is published: limit the task_runner role to trusted users, and check the project's GitHub advisories for a patch release.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112305
- 2026-10-24T00:22:25+00:00 analyst — Affected <=2.19.16 (CVE.org/VulnCheck, CVSS 8.8 v3.1). No vendor advisory or fixed version found: PR #3888 (the referenced patch) is closed, not merged; release 2.19.17 notes (runner check interval) do not mention a fix. Fix unknown until maintainers publish a GHSA/changelog. No exploitation or PoC seen; no X search done.

## Documents

- [advisory] VulnCheck: Semaphore UI through 2.19.16 RCE via task environment https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.16-rce-via-task-environment-ansible-variable-override
- [describes] PR #3888 harden RBAC, block task-level var injection (closed) https://github.com/semaphoreui/semaphore/pull/3888
- [mentions] semaphoreui/semaphore releases https://github.com/semaphoreui/semaphore/releases

## From the sources

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_