Semaphore UI: Remote code execution via overridden Ansible variables
Summary
Semaphore UI through version 2.19.16 lets users with the task_runner role override protected Ansible variables by supplying arbitrary keys in the task environment JSON. An attacker with such an account can set variables like ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to run commands as the Semaphore server user. This can expose encryption keys, SSH keys and other stored secrets.
Affected
- Semaphore UI 0 to 2.19.16 (according to the CVE record)
- Versions above 2.19.16: not affected according to the CVE record
Fixed in
Unknown. No fixed version has been confirmed. Do not assume that a later release is patched.
Workaround
- No workaround is provided in the CVE record.
- Remove the task_runner role from users who do not need it.
- Restrict access to the Semaphore web interface to trusted networks or a VPN.
- Run the Semaphore service with a dedicated, least-privilege OS account and limit the SSH keys and secrets it holds.
Exploitation
- Authentication required: the attacker needs a valid account with the task_runner role.
- No confirmed exploitation in the wild.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- A public proof of concept is not confirmed.
Our recommendation
- Review which accounts hold the task_runner role and remove it where it is not required.
- Do not expose the Semaphore web interface to the internet.
- Review recent task templates and task environment data for unexpected Ansible connection settings, and check audit logs.
- If abuse is suspected, rotate SSH keys and stored secrets and treat the server account as compromised.
- Monitor the vendor's releases and the upstream pull request for a fix, and update as soon as one is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Semaphore UI GitHub repository github.com
- Semaphore tasks.go at v2.19.16 github.com
- Semaphore TaskRunner.go at v2.19.16 github.com
- Semaphore pull request 3888 github.com
- VulnCheck advisory www.vulncheck.com
- VulDB entry 422412 vuldb.com
- OpenCVE entry CVE-2026-112305 app.opencve.io
- Strix CVE entry CVE-2026-112305 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:03.
Original description (NVD)
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.
NVD references (5)
- https://github.com/semaphoreui/semaphore
- https://github.com/semaphoreui/semaphore/blob/v2.19.16/api/projects/tasks.go#L39-L75
- https://github.com/semaphoreui/semaphore/blob/v2.19.16/services/tasks/TaskRunner.go#L395-L431
- https://github.com/semaphoreui/semaphore/pull/3888
- https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.16-rce-via-task-environment-ansible-variable-o…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.