{"schemaVersion":3,"id":"CVE-2026-112305","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.","dates":{"published":"2026-10-19T15:28:55.694Z","modified":"2026-10-19T17:40:14.094Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00563,"percentile":0.45763,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-20T00:00:00.000Z","score":0.00563,"percentile":0.45763}],"last30":[{"date":"2026-10-20T00:00:00.000Z","score":0.00563,"percentile":0.45763}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-915","name":"Improperly Controlled Modification of Dynamically-Determined Object Attributes","description":"The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/915.html"}],"affected":[{"vendor":"semaphoreui","product":"semaphore ui","name":"Semaphore UI","label":"semaphore ui","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.19.16","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.19.16","eol":null,"hubHref":"/vendor/semaphoreui/semaphore_ui"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/semaphoreui/semaphore/pull/3888","label":"github.com/semaphoreui/semaphore/pull/3888","hostname":"github.com","tags":["Issue Tracking","Technical Description","Patch"]},{"url":"https://github.com/semaphoreui/semaphore/blob/v2.19.16/services/tasks/TaskRunner.go#L395-L431","label":"github.com/semaphoreui/semaphore/blob/v2.19.16/services/tasks/TaskRunner.go","hostname":"github.com","tags":["Technical Description"]},{"url":"https://github.com/semaphoreui/semaphore/blob/v2.19.16/api/projects/tasks.go#L39-L75","label":"github.com/semaphoreui/semaphore/blob/v2.19.16/api/projects/tasks.go","hostname":"github.com","tags":["Technical Description"]},{"url":"https://github.com/semaphoreui/semaphore","label":"github.com/semaphoreui/semaphore","hostname":"github.com","tags":["Product"]},{"url":"https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.16-rce-via-task-environment-ansible-variable-override","label":"www.vulncheck.com/advisories/…","hostname":"www.vulncheck.com","tags":["Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-19T15:28:55.694Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-19T17:40:14.094Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":35,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T17:47:36.773Z","stale":false,"partial":false}}