CVE-2026-112305
CVE-2026-112305 · Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.
CVSS 8.7 · Alta · EPSS 0,6%
- Publicación
- Actualización
Productos y versiones afectados
semaphore ui
- Versiones
- ≥ 0, ≤ 2.19.16: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/semaphoreui/semaphore/pull/3888
- https://github.com/semaphoreui/semaphore/blob/v2.19.16/services/tasks/TaskRunner.go#L395-L431
- https://github.com/semaphoreui/semaphore/blob/v2.19.16/api/projects/tasks.go#L39-L75
- https://github.com/semaphoreui/semaphore
- https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.16-rce-via-task-environment-ansible-variable-override
- https://nvd.nist.gov/vuln/detail/CVE-2026-112305