Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-112305Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

High 8.8

In plain English

A high-severity security flaw in Semaphore UI from semaphoreui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 53.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.

Affected products (as reported)

Vendor	Product	Versions
semaphoreui	Semaphore UI	0 – through 2.19.16

Weakness: CWE-915 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/semaphoreui/semaphore/pull/3888 issue-tracking, technical-description, patch
https://github.com/semaphoreui/semaphore/blob/v2.19.16/services/tasks/TaskRunner.go#L395-L431 technical-description
https://github.com/semaphoreui/semaphore/blob/v2.19.16/api/projects/tasks.go#L39-L75 technical-description
https://github.com/semaphoreui/semaphore product
VulnCheck Advisory: Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override third-party-advisory