CVE-2026-112305

8.8High

Published 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-915

Impact

Authenticated users with the task_runner role can execute arbitrary commands on the Semaphore server to steal stored secrets, SSH keys, and encryption keys. They need network access and task execution privileges to trigger the exploit.

Root cause

The task runner allows arbitrary environment JSON keys to override protected Ansible variables like ansible_connection or ansible_ssh_common_args.

Affected systems

Semaphore UI through 2.19.16

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a version newer than 2.19.16 once available. If patching must wait, revoke the task_runner role from untrusted users or restrict task creation permissions.

shell

$ semaphore version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112305